Management System Operation Guide | eiso AI Management System Platform

Your computer and eiso: how data is created and kept, and how the functions connect (diagram) Expand

① Overview: what your computer and eiso each do

Your computer (or in-house server)

Create and keep basic data: records, results, inspections and measurement results from actual work
Current documents and forms: manuals, procedures, guidelines and forms
Keep outputs: Word and Excel files of eiso results (step folder\Output)
The original files are always held and managed by your company

Designate folders and filesThe text is read inside the browser and used only for AI writing. Files are not sent to the server, and the text read is not stored on the server.

Results on screenYou can use them directly as copy, Word, Excel, print or PDF.

Save to a folder on my computerAs Word and Excel files in the Output folder under the step folder in the folder you chose (Chrome and Edge).

Print and PDFUse the print window to print or choose "Save as PDF".

eiso (web and AI)

AI writing and analysis: plans, forms, evaluations and analysis results are created and shown on screen
Consent to save: your company chooses whether to save and where to save
Past work: find results saved in this browser (10 per step) by date or evaluation subject and view them again
Company Workspace (optional): stored on the server, encrypted per company, with sharing, review and approval among staff members

② How to create folders on your computer (recommended)

You only need to do this once. The folders your company creates hold the original documents and records, and the Output folders are created automatically when eiso saves.

1Create one storage folder

In File Explorer (⊞ Win + E), open "Documents", the D: drive or an in-house shared folder, create a new folder (Ctrl + Shift + N) and name it eiso Storage Folder.

2Create your company's data folders

Inside it, create a Management System folder, and inside that a 00_Documents folder and a folder for each step you operate (e.g. Context of the Organization, Risk Assessment); in each step folder, create Forms and Records.

3Choose it once in eiso

The first time you select "Save to a folder on my computer" in the operation results, choose the eiso Storage Folder, and allow the browser's request to view and save to the folder. From then on, it saves without asking.

How it looks when finished

Storage folder you choose once
Folders your company creates (original documents and records)
Folders eiso creates automatically when saving (Output)

eiso Storage FolderAnywhere: "Documents", the D: drive or an in-house shared folder
- Management SystemYour originals and records (same names as the "Recommended folder structure" in the operation guide)
  - 00_DocumentsManual, procedures and guidelines (current versions)
  - Context of the OrganizationSame layout for every step
    - FormsCurrent forms (keep the forms and change proposals created by eiso here)
    - RecordsBasic data (records, results, inspections, measurements). Designate this folder when you operate
  - risk assessment
    - Forms
    - Records
  - … for each step you operate
- Management System Operationeiso results
  - risk assessment
    - OutputExample: RiskAssessment_Line A press regular assessment_2026-10-22_143000.xlsx
  - … for each step you save
- Management system establishment · Operational data · Training materialsResults of other functions are also stored by function

Creating a new folder in Windows

File Explorer

+ New › Folder

Desktop
Documents
Local Disk (D:)

Company Forms
2026 Business Plan
eiso Storage Folder

① On the left, click where to put it (Documents, D: drive or a shared folder).
② At the top, click "New" › "Folder".
③ Type a name and press Enter.

What you do	Keyboard
Open File Explorer	`⊞ Win` + `E`
New folder	`Ctrl` + `Shift` + `N`
Rename	`F2`
Copy and paste a step folder	`Ctrl` + `C` → `Ctrl` + `V`
Mac (Finder) new folder	`⌘` + `Shift` + `N`

Quick way: create one step folder (including forms and records), copy and paste it, and change only the names. If several people share it, place it on an in-house shared folder (NAS). If you already use a folder, do not create a new one; choose that folder.

③ What is kept where

Material	Where it is created	Where it is kept	Relationship with eiso
Basic data (records, results, inspections, measurements)	Your company's work	Your computer: step\Records	When you operate, designate the folder and eiso reads, processes and analyzes it (materials designated as files are not stored)
Operational data (records, measured values, evaluations and actions entered in or imported into the register)	Your company (register screen)	Company Workspace on the eiso server (names and content are encrypted with a per-company key; numbers, dates, measured values and judgements are kept as they are for analysis)	Status and indicators are calculated and used in the register, the operation calendar and the operational data summary of AI writing. Original files stay in your own folder.
Current documents and forms	Management System Establishment (eiso) → approved by your company	Your computer: 00_Documents · step\Forms	In the Documented Information Management step, the list and revision history are organized
eiso output (plans, evaluations, analyses, reports)	eiso(AI)	Screen → on consent to save: step\Output (Word and Excel) · saved copy in this browser · Company Workspace	What is saved in this browser or the Company Workspace is carried over by the next step, and the copy saved in this browser can be viewed again in "Past work"
Content being entered	Your company (input fields)	This browser (automatic, not stored on the server)	Continue writing with "Load previous input"

④ The order for operating one step

Accumulate the basic data of your daily work in each step folder's Records folder.
In Operate, select a step and designate that folder (or files). In the Risk Assessment step, entering the evaluation subject name makes it easier to find later.
Click "Write with AI" and the result appears on screen. Review the content.
Consent to save: choose among Save in this browser, Save to a folder on my computer and Save to Company Workspace (you do not have to save).
If needed, distribute by print, PDF or Word, and next time find it again in "Past work" by date or evaluation subject.

⑤ Download the follow-along material (PPT)

A 20-page guide to print, keep beside your computer and follow page by page. The order is creating folders (steps 1 to 8) → connecting with eiso (9 to 17) → checklist, with a confirmation box on each page.
⬇ Download the step-by-step PPT (20 pages, Korean)

On a shared PC, click "Clear all" in "Past work" when you finish. Saving to a chosen folder works in Chrome and Edge; other browsers save to the download folder. The folder names are recommendations; if you already use a folder, choose it as it is.

Management System Operation guide Operation tracks · Your computer and eiso · View operation guide in detail Expand

Management System Operation: operate ISO management systems step by step with AI

Following the chapter structure common to ISO standards (the Harmonized Structure, HS), AI drafts each step of the annual operation.
The steps fall into three groups: planning (context of the organization → legal requirements → risk assessment → objectives), support and operation (12 steps from measuring equipment management to compliance evaluation, including process control), and evaluation and improvement (internal audit → management review → nonconformity and corrective action).
The selected standards and industry apply to every step, and the result of a previous step becomes the input of the next.

Try internal audit first: single internal audit pass, TBA

So that more companies can experience eiso Management System Operation first-hand, members can use internal audit alone as a single pass without a Management System Operation pass. Select one standard and, for 30 days from the day you first use 17 Internal audit, use the internal audit plan, checklists and report (written with AI), the virtual audit and the internal audit register (AI writing and the virtual audit combined, up to 12 times).

Even after the period ends, the records in the internal audit register are not deleted. They remain in the Company Workspace, so on your next visit you can review past audits, findings and corrective actions and continue auditing. Output written with AI and saved to the workspace remains until the workspace retention period (1 year by default; members who purchased only the single pass choose a 5-year retention period for the new workspace first).
Other steps (context of the organization, risk assessment, management review, etc.) and the handling of the corrective action register are used with a Management System Operation pass. If you pay for your first operation pass within 30 days of purchasing the single pass, TBA is deducted.

To start: in an operation track (Economic Prosperity Operation or Social Value Operation), select the step "17 Internal audit" and click "Write with AI", and the single pass amount is shown. The amounts are in eiso Pricing.

First choose an operation track. Economic Prosperity · Social Value · ICT

The operating method differs according to the characteristics of the standard. Documents (manual and procedures) can be integrated under the Harmonized Structure (HS) in management system establishment, but operation (Clause 8) differs between Economic Prosperity (based on ISO 9001) and Social Value (environmental protection + social justice), so the Clause 8 operation steps are run by track. A company that uses standards from both tracks (e.g. ISO 9001 + ISO 45001) turns on the "Integrated management system" box in Operate and uses the Harmonized Structure common steps (context of the organization, policy establishment, work allocation, risk assessment, objective setting, documented information management, analysis and evaluation, internal audit, management review, nonconformity and corrective action, improvement) at once, and the results are inherited by both tracks. The usage fee is counted across the three tracks: TBA for the first standard, and TBA for each additional standard in any track (excluding VAT, 1 year from the payment date).

Economic Prosperity operation 20 steps

A management system based on ISO 9001: operated along the flow of product and service realization from customer requirements (contracts) through design, purchasing, processes and nonconforming products (ISO 9001 Clause 8), and evaluated by customer satisfaction, product conformity and process performance.

Standards: ISO 9001 · ISO 22000 · ISO 13485 · ISO 19443 · IATF 16949 · ISO 21001

Steps only in this track: Contract management · Design and development management · Nonconforming product management

1 Context of the Organization · 2 Policy · 3 Roles and Responsibilities (R&R) · 4 Legal Requirements · 5 Risk Assessment · 6 Objectives · 7 Measuring Equipment Control · 8 Competence and Qualification · 9 Documented Information Control · 10 Externally Sourced Documented Information Control · 11 Contract Management · 12 Design and Development Control · 13 Supplier Control · 14 Process Control · 15 Nonconforming Output Control · 16 Analysis and Evaluation · 17 Internal Audit · 18 Management Review · 19 Nonconformity and Corrective Action · 20 Improvement

Economic Prosperity Operation

Social Value Operation 20 steps

A management system for social value that combines environmental protection and social justice. It centers on compliance obligations, environmental aspects, hazards, corruption, compliance and business interruption risks. It is run through worker and interested party participation and consultation, operational control (ISO 14001 and 45001, 8.1), emergency preparedness and response (8.2) and compliance evaluation (9.1.2), and is evaluated by legal compliance, environmental performance, accidents, incidents and interested party trust.

Standards: ISO 14001 · ISO 50001 · ISO 45001 · ISO 37001 · ISO 37301 · ISO 22301

Steps found only on this track: Participation, Consultation and Communication · Emergency Preparedness and Response · Compliance Evaluation

1 Context of the Organization · 2 Policy · 3 Roles and Responsibilities (R&R) · 4 Legal Requirements · 5 Risk Assessment · 6 Objectives · 7 Participation, Consultation and Communication · 8 Measuring Equipment Control · 9 Competence and Qualification · 10 Documented Information Control · 11 Externally Sourced Documented Information Control · 12 Supplier and Contractor Control · 13 Operational Control · 14 Emergency Preparedness and Response · 15 Analysis and Evaluation · 16 Compliance Evaluation · 17 Internal Audit · 18 Management Review · 19 Nonconformity and Corrective Action · 20 Improvement

Social Value Operation

ICT Management System Operation 16 steps

AI and information security management systems: assess the risks of AI systems and information assets, introduce controls, and operate and monitor only what has been approved. A Statement of Applicability (SoA) is kept separately for each standard and linked together in a control mapping table.

Standards: ISO/IEC 42001 · ISO/IEC 27001

Steps found only on this track: AI Selection · AI System Inventory · Impact Assessment · Control Implementation and Statement of Applicability · Verification and Use Approval · Operational Control

1 AI Context Analysis · 2 AI Policy, R&R and Objectives · 3 AI Selection · 4 AI System Inventory · 5 AI Risk Assessment · 6 AI System Impact Assessment · 7 Control Implementation and Statement of Applicability (SoA) · 8 Verification and Use Approval · 9 Operational Control · 10 Documented Information Control · 11 Monitoring, Change and Revision Control · 12 Internal Audit · 13 Legal Requirements Identification and Monitoring · 14 Management Review · 15 Nonconformity and Corrective Action · 16 Improvement

ICT Management System Operation Guide

View the operation guide in detail Related standards · Role allocation · 20 operation steps (two tracks) · What is done and produced at each step · Usage examples · Fees Expand

When operating two or more standards together: choose an operation method Management system standards with the Harmonized Structure (HS)

Choose only when you operate two or more standards. If you operate a single standard, you do not need to choose, and the guide below applies as it is. Because the standards share the same Harmonized Structure (HS), you can operate them together or separately for each standard. The fee is the same either way.

Integrated operation Default

The selected standards are run as one flow using this track's 20 steps.
Standards from two tracks (for example, ISO 9001 + ISO 45001) are used together as an "integrated management system" in the common steps only, while the Clause 8 operation steps are used separately for each track.
Common requirements (Harmonized Structure) are written once, and requirements specific to a standard are written with the [standard name] attached.
Registers (issues, risks, objectives, legal requirements, nonconformities) are kept as one, and each line shows the standard it applies to.
How to use each standard separately is added at the end of the result.

When to use: the same scope and the same responsible organization operate several standards together and are audited togetherView integrated operation ›

Independent operation by standard

A tab for each standard's operation platform appears above Operate, and you operate one standard at a time.
Documents, registers, numbers and the results kept in this browser are separate for each standard.
Common requirements (Clauses 4 to 7, 9 and 10) are also written under that standard's name and scope.
Operation results of other standards are used for reference only.

When to use: the scope, responsible organization, certification timing or certification body differs for each standard, or you are operating one standard firstView independent operation by standard ›

If you do not choose, the integrated operation guide is shown.

Independent operation by standard: each standard is operated separately

In Operate, if you select two or more standards and set the operation method to independent operation by standard, a tab for each standard's operation platform appears, and each platform uses that standard's 20 steps separately. If you select a standard below, that standard's operation guide is shown (the operation steps, what is done and produced at each step, and the relationship map above are the same for all standards on this track).

Outputs and storage: Document numbers, registers and forms are separate for each standard. The step results kept in this browser are also kept separately for each standard, so the results of one standard are not carried over to another standard's steps.
Common requirements: The common requirements of the Harmonized Structure (HS) (Clauses 4 to 7, 9 and 10) are also written under that standard's name and scope. Content that is the same as for another standard is noted in a single line as "See the operation results of the other standard".
Usage fee: the same as integrated operation. TBA for the first standard and TBA for each additional standard (1 year from the payment date, excluding VAT).
When switching to integrated operation: If you choose integrated operation above, the selected standards are continued as one flow. Results written for a single standard are stored under that standard, and results written in integration for two or more standards are stored in the track-wide storage, so paste the results you need to continue.
Company Workspace: When you save to the workspace, the standard of that result is saved with it, and in independent operation the next step receives only results saved under the same standard.
Differences from ICT Management System Operation: How to choose the method, the operation platform tab for each standard and the storage rules are the same as for ICT. However, the standards on this track share the same 20 steps, so the common guide above applies as it is to the operation steps, what is done and produced at each step, and the relationship map, and only what differs by standard (what is managed, the steps given weight, and specific requirements) is shown below. For ICT, ISO/IEC 42001 and ISO/IEC 27001 differ in step names and tasks, so a separate operation step guide is provided for ISO/IEC 27001.

Choose a standard

ISO 9001 (Quality) operation guide

What is managed: Consistently provides products and services that meet customer and legal requirements, and increases customer satisfaction.
Steps given weight: 11 Contract Management 12 Design and Development Control 13 Supplier Control 14 Process Control 15 Nonconforming Output Control 7 Measuring Equipment Control 16 Analysis and Evaluation
Specific requirements to address: 8.2 Determination and review of requirements for products and services · 8.3 Design and development (inputs, reviews, verification, validation, changes) · 8.4 Evaluation, selection and monitoring of external providers · 8.5 Production and service provision (identification, traceability, customer property, preservation, post-delivery activities, change control) · 8.6 Release approval · 8.7 Nonconforming outputs · 7.1.5 Monitoring and measuring resources · 9.1.2 Customer satisfaction

In independent operation, add "ISO 9001" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 9001 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 9001 operation platform ›

ISO 22000 (Food Safety) operation guide

What is managed: Controls the hazards that can arise in the food chain to provide safe food.
Steps given weight: 5 Risk Assessment 14 Process Control 13 Supplier Control 15 Nonconforming Output Control 7 Measuring Equipment Control 16 Analysis and Evaluation
Specific requirements to address: 8.2 Prerequisite programs (PRP) · 8.5 Hazard analysis and the hazard control plan (CCPs and OPRPs in HACCP) · 8.3 Traceability · 8.4 Emergency preparedness and response · 8.7 Control of monitoring and measuring · 8.8 Verification of PRPs and the hazard control plan · 8.9 Control of nonconforming products and processes (including withdrawal and recall) · 7.4.2 External communication

In independent operation, add "ISO 22000" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 22000 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 22000 operation platform ›

ISO 13485 (Medical Devices) operation guide

What is managed: Designs, produces and supplies safe and effective medical devices that meet regulatory requirements.
Steps given weight: 4 Legal Requirements 12 Design and Development Control 14 Process Control 13 Supplier Control 15 Nonconforming Output Control 7 Measuring Equipment Control
Specific requirements to address: 4.2.3 Medical device file · 7.1 Planning of product realization and risk management (ISO 14971) · 7.3 Design and development (design transfer, 7.3.9 design changes) · 7.4 Purchasing · 7.5.6 Process validation · 7.5.7 Validation of sterilization and sterile barrier systems · 7.5.8 to 7.5.9 Identification and traceability · 7.6 Monitoring and measuring equipment · 8.2.2 Complaint handling · 8.2.3 Reporting to regulatory authorities · 8.3 Nonconforming product. This standard does not follow the Harmonized Structure (HS), so the clause numbers differ.

In independent operation, add "ISO 13485" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 13485 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 13485 operation platform ›

ISO 19443 (Nuclear) operation guide

What is managed: Supplies items and services important to nuclear safety with the same quality throughout the entire supply chain.
Steps given weight: 8 Competence and Qualification 13 Supplier Control 14 Process Control 15 Nonconforming Output Control 1 Context of the Organization
Specific requirements to address: Adds nuclear sector requirements to the ISO 9001 requirements: nuclear safety culture · identification and graded control of items and services important to nuclear safety · prevention and detection of counterfeit, fraudulent and suspect items (CFSI) · flow-down of requirements to each stage of the supply chain · control of special processes and competence. Clause numbers are checked against the original text.

In independent operation, add "ISO 19443" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 19443 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 19443 operation platform ›

IATF 16949 (Automotive) operation guide

What is managed: Adds automotive customer-specific requirements (CSR) and Core Tools to ISO 9001 to prevent defects and reduce variation and waste in the supply chain.
Steps given weight: 12 Design and Development Control 14 Process Control 7 Measuring Equipment Control 13 Supplier Control 15 Nonconforming Output Control 17 Internal Audit
Specific requirements to address: 4.4.1.2 Product safety · 6.1.2.3 Contingency plans · 7.1.5.1.1 Measurement systems analysis (MSA) · 7.2.3 Internal auditor competency · 8.3.3.3 Special characteristics · 8.3.4.4 Production part approval process (PPAP) · 8.5.1.1 Control plan · 8.5.6.1.1 Temporary change of process controls · 9.1.1.1 Monitoring and measurement of manufacturing processes · 9.1.1.2 Statistical tools (SPC) · 9.2.2.2 to 9.2.2.4 System, manufacturing process and product audits · 10.2.3 Problem solving · 10.2.4 Error proofing. Core Tools: APQP · PPAP · FMEA · SPC · MSA

In independent operation, add "IATF 16949" to document numbers, register names and table titles so that only this standard's records are used (for example, "IATF 16949 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the IATF 16949 operation platform ›

ISO 21001 (Educational Organizations) operation guide

What is managed: Provides educational products and services that meet the needs of learners and other beneficiaries.
Steps given weight: 1 Context of the Organization 11 Contract Management 12 Design and Development Control 14 Process Control 15 Nonconforming Output Control 8 Competence and Qualification 16 Analysis and Evaluation
Specific requirements to address: Focus on learners and other beneficiaries (4.2 · 5.1.2) · 8.2 Requirements for educational products and services (guidance on admission and enrolment conditions) · 8.3 Design and development of curricula · 8.5 Delivery of education and assessment of learning · 8.7 Nonconforming educational outputs · 7.2 Competence of faculty and instructors · 9.1.2 Satisfaction of learners, other beneficiaries and staff · Consideration for learners who need special support

In independent operation, add "ISO 21001" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 21001 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 21001 operation platform ›

Independent operation by standard: each standard is operated separately

Outputs and storage: Document numbers, registers and forms are separate for each standard. The step results kept in this browser are also kept separately for each standard, so the results of one standard are not carried over to another standard's steps.
Common requirements: The common requirements of the Harmonized Structure (HS) (Clauses 4 to 7, 9 and 10) are also written under that standard's name and scope. Content that is the same as for another standard is noted in a single line as "See the operation results of the other standard".
Usage fee: the same as integrated operation. TBA for the first standard and TBA for each additional standard (1 year from the payment date, excluding VAT).
When switching to integrated operation: If you choose integrated operation above, the selected standards are continued as one flow. Results written for a single standard are stored under that standard, and results written in integration for two or more standards are stored in the track-wide storage, so paste the results you need to continue.
Company Workspace: When you save to the workspace, the standard of that result is saved with it, and in independent operation the next step receives only results saved under the same standard.
Differences from ICT Management System Operation: How to choose the method, the operation platform tab for each standard and the storage rules are the same as for ICT. However, the standards on this track share the same 20 steps, so the common guide above applies as it is to the operation steps, what is done and produced at each step, and the relationship map, and only what differs by standard (what is managed, the steps given weight, and specific requirements) is shown below. For ICT, ISO/IEC 42001 and ISO/IEC 27001 differ in step names and tasks, so a separate operation step guide is provided for ISO/IEC 27001.

Choose a standard

ISO 14001 (Environment) operation guide

What is managed: Manages environmental aspects and compliance obligations to improve environmental performance and prevent pollution.
Steps given weight: 1 Context of the Organization 5 Risk Assessment 4 Legal Requirements 13 Operational Control 14 Emergency Preparedness and Response 16 Compliance Evaluation 12 Supplier and Contractor Control
Specific requirements to address: 4.1 Environmental conditions (pollution level, availability of natural resources, climate change, biodiversity, ecosystem health) · 6.1.2 Environmental aspects (normal, abnormal and potential emergency situations, life cycle perspective, significant environmental aspects) · 6.1.3 Compliance obligations · 6.1.4 Risks and opportunities · 6.3 Planning of changes · 8.1 Operational planning and control (life cycle perspective, control of outsourced processes) · 8.2 Emergency preparedness and response (periodic testing where practicable) · 9.1.1 Monitoring (calibrated and verified equipment) · 9.1.2 Compliance evaluation

In independent operation, add "ISO 14001" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 14001 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 14001 operation platform ›

ISO 50001 (Energy) operation guide

What is managed: Continually improves energy performance, including energy efficiency, use and consumption.
Steps given weight: 5 Risk Assessment 6 Objectives 8 Measuring Equipment Control 13 Operational Control 12 Supplier and Contractor Control 15 Analysis and Evaluation
Specific requirements to address: 6.3 Energy review (significant energy uses, SEU) · 6.4 Energy performance indicators (EnPI) · 6.5 Energy baseline (EnB) · 6.6 Planning for collection of energy data · 8.1 Operational control (operating criteria for SEUs) · 8.2 Design · 8.3 Procurement · 9.1 Demonstration of improvement in energy performance

In independent operation, add "ISO 50001" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 50001 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 50001 operation platform ›

ISO 45001 (Occupational Health and Safety) operation guide

What is managed: Prevents work-related injury and ill health and creates a safe and healthy workplace.
Steps given weight: 7 Participation, Consultation and Communication 5 Risk Assessment 13 Operational Control 12 Supplier and Contractor Control 14 Emergency Preparedness and Response 16 Compliance Evaluation 19 Nonconformity and Corrective Action
Specific requirements to address: 5.4 Consultation and participation of workers · 6.1.2 Hazard identification and assessment of risks · 6.1.3 Legal requirements · 8.1.2 Eliminating hazards and reducing OH&S risks (hierarchy of controls: elimination → substitution → engineering → administrative → personal protective equipment) · 8.1.3 Management of change · 8.1.4 Procurement (contractors and outsourcing) · 8.2 Emergency preparedness and response · 9.1.2 Compliance evaluation · 10.2 Incidents, nonconformities and corrective action (investigation with worker participation)

In independent operation, add "ISO 45001" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 45001 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 45001 operation platform ›

ISO 37001 (Anti-bribery) operation guide

What is managed: Establishes a system to prevent, detect and respond to bribery.
Steps given weight: 5 Risk Assessment 12 Supplier and Contractor Control 13 Operational Control 7 Participation, Consultation and Communication 9 Competence and Qualification 19 Nonconformity and Corrective Action
Specific requirements to address: Bribery risk assessment · Anti-bribery compliance function (independence and authority) · Employment procedures and due diligence on personnel · Anti-bribery training and awareness · Due diligence on business associates · Financial and non-financial controls · Management of gifts, hospitality and donations · Raising concerns (reporting) and prohibition of retaliation · Investigation and handling. Clause numbers differ by edition (2016 · 2025), so they are checked against the original text.

In independent operation, add "ISO 37001" to document numbers, register names and table titles so that only this standard's records are used (for example, "ISO 37001 Risk and Opportunity Register"). Results of other standards operated by the same organization are used for reference only.

Operate on the ISO 37001 operation platform ›

ISO 37301 (Compliance) operation guide

What is managed: Meets compliance obligations and builds a compliance culture to prevent violations.
Steps given weight: 4 Legal Requirements 5 Risk Assessment 7 Participation, Consultation and Communication 9 Competence 16 Compliance Evaluation 19 Nonconformity and Corrective Action
Specific requirements to address: 4.5 Compliance obligations · 4.6 Compliance risk assessment · 5.1.2 Compliance culture · 5.3.2 Compliance function · 7.3 Awareness · 8.3 Raising concerns · 8.4 Investigation processes · 9.1 Monitoring compliance performance

In independent operation, add "ISO 37301" to document numbers, registers and table titles and use only this standard's own items (for example, "ISO 37301 Risks and opportunities register"). Results from other standards operated by the same organization are used for reference only.

Operate it on the ISO 37301 operation platform ›

ISO 22301 (Business Continuity) Operation Guide

What is managed: Even if business is disrupted, the organization continues and recovers its key products and services at a defined level.
Steps given weight: 5 Risk Assessment 13 Operational Control 14 Emergency Preparedness and Response 12 Supplier and Contractor Management 15 Analysis and Evaluation
Specific requirements to address: 8.2 Business impact analysis (BIA) and risk assessment · 8.3 Business continuity strategies and solutions · 8.4 Business continuity plans and procedures (response structure, warning, communication, recovery) · 8.5 Exercise program · 8.6 Evaluation of business continuity documentation and capabilities (including partners and suppliers)

In independent operation, add "ISO 22301" to document numbers, registers and table titles and use only this standard's own items (for example, "ISO 22301 Risks and opportunities register"). Results from other standards operated by the same organization are used for reference only.

Operate it on the ISO 22301 operation platform ›

Economic Prosperity Operation: Related Standards and Operating Points

The Economic Prosperity track is based on ISO 9001 (quality) and operates the flow of creating products and services from customer requirements through to delivery and after delivery (Clause 8, product and service realization). Food safety (ISO 22000), medical devices (ISO 13485), nuclear (ISO 19443), automotive (IATF 16949) and educational organizations (ISO 21001) are standards that add sector requirements to this flow, so within the same 20 steps the requirements specific to each standard are handled together. Performance is viewed through customer satisfaction, product conformity and process performance.

Operation flow

Planning (1-6) 1 Context of the Organization · 2 Policy · 3 Roles and Responsibilities (R&R) · 4 Legal Requirements · 5 Risk Assessment · 6 Objectives
Support (7-10) 7 Monitoring and Measuring Equipment · 8 Competence · 9 Control of Documented Information · 10 Control of Documented Information of External Origin
Operation · ISO 9001 Clause 8 (11-15) 11 Contract Management · 12 Design and Development · 13 Supplier Management · 14 Process Control · 15 Control of Nonconforming Outputs
Evaluation and improvement (16-20) 16 Analysis and Evaluation · 17 Internal Audit · 18 Management Review · 19 Nonconformity and Corrective Action · 20 Improvement

Standard	What it manages	Steps given weight	Requirements specific to the standard to handle at each step (clauses)
ISO 9001Quality	Consistently provides products and services that meet customer and legal requirements, and increases customer satisfaction.	7 Monitoring and Measuring Equipment 11 Contract Management 12 Design and Development 13 Supplier Management 14 Process Control 15 Control of Nonconforming Outputs 16 Analysis and Evaluation	8.2 Determination and review of requirements for products and services · 8.3 Design and development (inputs, reviews, verification, validation, changes) · 8.4 Evaluation, selection and monitoring of external providers · 8.5 Production and service provision (identification, traceability, customer property, preservation, post-delivery activities, change control) · 8.6 Release approval · 8.7 Nonconforming outputs · 7.1.5 Monitoring and measuring resources · 9.1.2 Customer satisfaction
ISO 22000Food safety	Controls the hazards that can arise in the food chain to provide safe food.	5 Risk Assessment 7 Monitoring and Measuring Equipment 13 Supplier Management 14 Process Control 15 Control of Nonconforming Outputs 16 Analysis and Evaluation	8.2 Prerequisite programs (PRP) · 8.5 Hazard analysis and the hazard control plan (CCPs and OPRPs in HACCP) · 8.3 Traceability · 8.4 Emergency preparedness and response · 8.7 Control of monitoring and measuring · 8.8 Verification of PRPs and the hazard control plan · 8.9 Control of nonconforming products and processes (including withdrawal and recall) · 7.4.2 External communication
ISO 13485Medical devices	Designs, produces and supplies safe and effective medical devices that meet regulatory requirements.	4 Legal Requirements 7 Monitoring and Measuring Equipment 12 Design and Development 13 Supplier Management 14 Process Control 15 Control of Nonconforming Outputs	4.2.3 Medical device file · 7.1 Planning of product realization and risk management (ISO 14971) · 7.3 Design and development (design transfer, 7.3.9 design changes) · 7.4 Purchasing · 7.5.6 Process validation · 7.5.7 Validation of sterilization and sterile barrier systems · 7.5.8 to 7.5.9 Identification and traceability · 7.6 Monitoring and measuring equipment · 8.2.2 Complaint handling · 8.2.3 Reporting to regulatory authorities · 8.3 Nonconforming product. This standard does not follow the Harmonized Structure (HS), so the clause numbers differ.
ISO 19443Nuclear	Supplies items and services important to nuclear safety with the same quality throughout the entire supply chain.	1 Context of the Organization 8 Competence 13 Supplier Management 14 Process Control 15 Control of Nonconforming Outputs	Adds nuclear sector requirements to the ISO 9001 requirements: nuclear safety culture · identification and graded control of items and services important to nuclear safety · prevention and detection of counterfeit, fraudulent and suspect items (CFSI) · flow-down of requirements to each stage of the supply chain · control of special processes and competence. Clause numbers are checked against the original text.
IATF 16949Automotive	Adds automotive customer-specific requirements (CSR) and Core Tools to ISO 9001 to prevent defects and reduce variation and waste in the supply chain.	7 Monitoring and Measuring Equipment 12 Design and Development 13 Supplier Management 14 Process Control 15 Control of Nonconforming Outputs 17 Internal Audit	4.4.1.2 Product safety · 6.1.2.3 Contingency plans · 7.1.5.1.1 Measurement systems analysis (MSA) · 7.2.3 Internal auditor competency · 8.3.3.3 Special characteristics · 8.3.4.4 Production part approval process (PPAP) · 8.5.1.1 Control plan · 8.5.6.1.1 Temporary change of process controls · 9.1.1.1 Monitoring and measurement of manufacturing processes · 9.1.1.2 Statistical tools (SPC) · 9.2.2.2 to 9.2.2.4 System, manufacturing process and product audits · 10.2.3 Problem solving · 10.2.4 Error proofing. Core Tools: APQP · PPAP · FMEA · SPC · MSA
ISO 21001Educational organizations	Provides educational products and services that meet the needs of learners and other beneficiaries.	1 Context of the Organization 8 Competence 11 Contract Management 12 Design and Development 14 Process Control 15 Control of Nonconforming Outputs 16 Analysis and Evaluation	Focus on learners and other beneficiaries (4.2 · 5.1.2) · 8.2 Requirements for educational products and services (guidance on admission and enrolment conditions) · 8.3 Design and development of curricula · 8.5 Delivery of education and assessment of learning · 8.7 Nonconforming educational outputs · 7.2 Competence of faculty and instructors · 9.1.2 Satisfaction of learners, other beneficiaries and staff · Consideration for learners who need special support

This track has no Emergency Preparedness and Response or Compliance Evaluation step. ISO 22000 emergency preparedness and response (8.4) and IATF 16949 contingency plans (6.1.2.3) are handled in 14 Process Control, and confirmation that legal and regulatory requirements (ISO 13485 regulatory requirements, food-related laws and regulations) are met is handled in 4 Legal Requirements and 16 Analysis and Evaluation.

When several standards are selected together, common requirements are written once, and lines that apply to only one standard are prefixed with the standard name, as in [ISO 22000]. 15 Control of Nonconforming Outputs covers the nonconforming outputs (products and services) of the standards in this track: nonconforming product for ISO 13485 (8.3), potentially unsafe products and withdrawal/recall for ISO 22000 (8.9), and nonconforming educational outputs for ISO 21001 (8.7).

Points often missed

Contract review (11) is done before accepting an order and again when the contract changes. Keep confirmation records for telephone and verbal orders as well.
A company that does not carry out design and development (12) keeps the justification for excluding it from the scope.
For external providers (13), do not stop at the initial evaluation; define the re-evaluation cycle and performance monitoring.
Nonconforming products (15) are dealt with through to disposition (rework, concession, scrap); cause analysis and prevention of recurrence are done in 19 Nonconformity and Corrective Action.
If a measuring instrument (7) is found faulty, evaluate whether earlier results measured with it are still valid.

Clause numbers may differ depending on the edition of the standard. Check them against the text of the standard. Step numbers are the numbers within this track.

Social Value Operation: Related Standards and Operating Points

The Social Value track combines environmental protection and social justice and operates mainly around compliance obligations and the risks of environmental aspects, hazards, corruption, compliance and business disruption. Participation and consultation of workers and interested parties (ISO 45001 5.4), operational control (ISO 14001 and 45001 8.1), emergency response (8.2) and compliance evaluation (9.1.2) are the pillars of operation, and performance is viewed through legal compliance, environmental performance, incidents and accidents, and interested parties' trust.

Operation flow

Planning (1-6) 1 Context of the Organization · 2 Policy · 3 Roles and Responsibilities (R&R) · 4 Legal Requirements · 5 Risk Assessment · 6 Objectives
Participation and support (7-11) 7 Participation, Consultation and Communication · 8 Monitoring and Measuring Equipment · 9 Competence · 10 Control of Documented Information · 11 Control of Documented Information of External Origin
Operation · ISO 14001 and 45001 Clause 8 (12-14) 12 Supplier and Contractor Management · 13 Operational Control · 14 Emergency Preparedness and Response
Evaluation and improvement (15-20) 15 Analysis and Evaluation · 16 Compliance Evaluation · 17 Internal Audit · 18 Management Review · 19 Nonconformity and Corrective Action · 20 Improvement

Standard	What it manages	Steps given weight	Requirements specific to the standard to handle at each step (clauses)
ISO 14001Environment	Manages environmental aspects and compliance obligations to improve environmental performance and prevent pollution.	1 Context of the Organization 4 Legal Requirements 5 Risk Assessment 12 Supplier and Contractor Management 13 Operational Control 14 Emergency Preparedness and Response 16 Compliance Evaluation	4.1 Environmental conditions (pollution level, availability of natural resources, climate change, biodiversity, ecosystem health) · 6.1.2 Environmental aspects (normal, abnormal and potential emergency situations, life cycle perspective, significant environmental aspects) · 6.1.3 Compliance obligations · 6.1.4 Risks and opportunities · 6.3 Planning of changes · 8.1 Operational planning and control (life cycle perspective, control of outsourced processes) · 8.2 Emergency preparedness and response (periodic testing where practicable) · 9.1.1 Monitoring (calibrated and verified equipment) · 9.1.2 Compliance evaluation
ISO 50001Energy	Continually improves energy performance, including energy efficiency, use and consumption.	5 Risk Assessment 6 Objectives 8 Monitoring and Measuring Equipment 12 Supplier and Contractor Management 13 Operational Control 15 Analysis and Evaluation	6.3 Energy review (significant energy uses, SEU) · 6.4 Energy performance indicators (EnPI) · 6.5 Energy baseline (EnB) · 6.6 Planning for collection of energy data · 8.1 Operational control (operating criteria for SEUs) · 8.2 Design · 8.3 Procurement · 9.1 Demonstration of improvement in energy performance
ISO 45001Occupational health and safety	Prevents work-related injury and ill health and creates a safe and healthy workplace.	5 Risk Assessment 7 Participation, Consultation and Communication 12 Supplier and Contractor Management 13 Operational Control 14 Emergency Preparedness and Response 16 Compliance Evaluation 19 Nonconformity and Corrective Action	5.4 Consultation and participation of workers · 6.1.2 Hazard identification and assessment of risks · 6.1.3 Legal requirements · 8.1.2 Eliminating hazards and reducing OH&S risks (hierarchy of controls: elimination → substitution → engineering → administrative → personal protective equipment) · 8.1.3 Management of change · 8.1.4 Procurement (contractors and outsourcing) · 8.2 Emergency preparedness and response · 9.1.2 Compliance evaluation · 10.2 Incidents, nonconformities and corrective action (investigation with worker participation)
ISO 37001Anti-bribery	Establishes a system to prevent, detect and respond to bribery.	5 Risk Assessment 7 Participation, Consultation and Communication 9 Competence 12 Supplier and Contractor Management 13 Operational Control 19 Nonconformity and Corrective Action	Bribery risk assessment · Anti-bribery compliance function (independence and authority) · Employment procedures and due diligence on personnel · Anti-bribery training and awareness · Due diligence on business associates · Financial and non-financial controls · Management of gifts, hospitality and donations · Raising concerns (reporting) and prohibition of retaliation · Investigation and handling. Clause numbers differ by edition (2016 · 2025), so they are checked against the original text.
ISO 37301Compliance	Meets compliance obligations and builds a compliance culture to prevent violations.	4 Legal Requirements 5 Risk Assessment 7 Participation, Consultation and Communication 9 Competence 16 Compliance Evaluation 19 Nonconformity and Corrective Action	4.5 Compliance obligations · 4.6 Compliance risk assessment · 5.1.2 Compliance culture · 5.3.2 Compliance function · 7.3 Awareness · 8.3 Raising concerns · 8.4 Investigation processes · 9.1 Monitoring compliance performance
ISO 22301Business continuity	Even if business is disrupted, the organization continues and recovers its key products and services at a defined level.	5 Risk Assessment 12 Supplier and Contractor Management 13 Operational Control 14 Emergency Preparedness and Response 15 Analysis and Evaluation	8.2 Business impact analysis (BIA) and risk assessment · 8.3 Business continuity strategies and solutions · 8.4 Business continuity plans and procedures (response structure, warning, communication, recovery) · 8.5 Exercise program · 8.6 Evaluation of business continuity documentation and capabilities (including partners and suppliers)

This track has no Contract Management, Design and Development or Control of Nonconforming Outputs step. Customer and interested-party requirements are handled in 1 Context of the Organization and 4 Legal Requirements; the life cycle perspective of ISO 14001 and 45001, elimination of hazards at the design stage (8.1) and ISO 50001 design (8.2) are handled in 13 Operational Control; and deviations from operating criteria, accidents and incidents are handled in 19 Nonconformity and Corrective Action.

When several standards are selected together, common requirements are written once, and lines that apply to only one standard are prefixed with the standard name, as in [ISO 45001]. If a social justice standard (ISO 37001, 37301 or 22301) is selected, the Clause 8 controls and procedures of that standard are used as the operating criteria in 13 Operational Control, and if ISO 37001 or 37301 is selected, a channel for raising concerns (reporting) must be included in 7 Participation, Consultation and Communication.

Points often missed

For environmental aspects (5), consider not only normal operation but also abnormal and emergency situations and the life cycle (from raw material purchase to disposal).
Workers take part in occupational health and safety risk assessment (5), and countermeasures are set in the order of the hierarchy of controls (starting with elimination).
Consultation (7) means hearing workers' opinions before a decision; participation means taking part in the decision together. Keep records of both.
Do not stop at having an emergency response (14) procedure: conduct drills and revise the procedure based on the drill results.
Compliance evaluation (16) keeps evidence and results for every item in the legal requirements list (4).

Clause numbers may differ depending on the edition of the standard. Check them against the text of the standard. Step numbers are the numbers within this track.

Division of roles: eiso plans, your computer holds basic data, and eiso performs the overall analysis

eiso: Plan	Your computer: actual work and basic data	eiso: processing, analysis and synthesis of information
eiso prepares the plan and criteria for each step, proposed changes to forms and documents (procedures and guidelines), and draft tables and checklists.	Your company does its actual work with the revised forms and accumulates basic data (records, results, inspections, measurement results) on your own computer (or in-house server). You do not need to do totalling or analysis separately.	When you operate, if you specify the folder (or file) for that step, eiso processes (organizes and totals), analyzes (against objectives and criteria, trends, causes) and synthesizes (judgment, action, next plan) the basic data. Files are read only inside the browser, are not sent to the server and are not stored.

Yearly operation flow: plan and forms in eiso → work and basic data on your computer → specify the folder when you operate → eiso processes, analyzes and synthesizes, and revises the plan and forms. The Output begins with "Processing, analysis and synthesis of basic data" and ends with "Basic data to accumulate on your computer" (data, form, folder, person in charge, cycle).

Recommended folder structure: what your computer does in each step and the basic data to designate to eiso Expand

Management System\00_Documents: manual, procedures and guidelines (current versions). Under each step folder, keep a Forms folder (current forms) and a Records folder (basic data).

Step	Recommended folder	What is done on your computer (basic data)	Materials to designate during operation (analyzed by eiso)
1	`Management System\Context of the Organization`	Compile business plans and management results; gather opinions from customers, partners and employees	Business plan, previous year's management analysis and KPI results, customer and partner opinions, organization chart
2	`Management System\Legal Requirements`	Carry out permits, statutory notifications and statutory inspections; check for changes in laws	List of permits and notifications, statutory inspection and measurement records, current list of legal requirements
3	`Management System\Risk Assessment`	Site inspections and risk assessment meetings; carry out the actions decided	Current risk assessment tables (environmental aspects table, occupational risk assessment table, PFMEA, control plan), process flow chart, material balance (raw materials, emissions), permit and measurement records, accident and near-miss records, action results
4	`Management System\Objectives`	Compile objective results and monthly reports; carry out action plans	Objectives and KPI register, monthly results, action plan progress table
5	`Management System\Monitoring and Measuring Equipment`	Request calibration and receive certificates; carry out verification; display calibration status	Instrument register, calibration certificates, verification records
6	`Management System\Competence`	Conduct education, competence evaluation and recognition	Education and training results, competence recognition records, competence evaluation table (excluding personal information)
7	`Management System\Control of Documented Information`	Create, revise and distribute documents; retain and dispose of records	Document list (master list), revision history, distribution records, records retention list
8	`Management System\Control of Documented Information of External Origin`	Obtain standards, laws and customer documents; confirm and distribute the latest versions	External document list, receipt and distribution records
9	`Management System\Contract Management`	Review quotations, orders and contracts; handle customer change requests	Contract review forms, contract and order register, customer change request records
10	`Management System\Design and Development`	Carry out design reviews, verification and validation; handle design changes	Design plan, review, verification and validation records, design change records
11	`Management System\Supplier Management`	Supplier evaluation and re-evaluation; incoming inspection	Approved supplier list, supplier evaluation forms, incoming inspection records
12	`Management System\Process Control`	Operate according to the control plan and work standards; process and daily inspections; handle changes	Control plan and QC process chart, work standards, process and daily inspection records, change records
13	`Management System\Control of Nonconforming Outputs`	Identify, segregate and dispose of nonconforming products (rework, concession, scrap)	Nonconformity register, disposition records
14	`Management System\Emergency Preparedness and Response`	Conduct emergency drills; inspect emergency equipment	Emergency response plan, drill result report, emergency equipment inspection checklist
15	`Management System\Analysis and Evaluation`	Measure indicators and compile data; customer satisfaction surveys	KPI results, customer satisfaction survey results, process and supplier performance data
16	`Management System\Compliance Evaluation`	Confirm compliance with each law and gather evidence	Legal requirements list, measurement and inspection results, permit status, previous compliance evaluation results
17	`Management System\Internal Audit`	Conduct audits (interviews, on-site verification) and record results	Audit materials, customer company forms, statement of applicability, previous audit results, audit records (in the Internal Audit box below)
18	`Management System\Management Review`	Hold management review meetings; carry out decisions	Summary of results of each step, minutes of previous management review, performance data
19	`Management System\Nonconformity and Corrective Action`	Investigate causes, carry out actions and verify effectiveness	Nonconformity and corrective action request forms, investigation records, evidence of action results
20	`Management System\Participation, Consultation and Communication`	Hold consultative body meetings; carry out communication; receive and handle reports of concerns	Consultative body minutes, communication records (notices, training, external replies), register of reported concerns
21	`Management System\Improvement`	Carry out improvement tasks and verify their effect; horizontal deployment of good practices	Management review minutes and decisions, corrective action results, objectives (KPI) results, improvement suggestions and audit observations
22	`Management System\Policy`	Review, approve and sign the policy; post, announce and train on it; confirm understanding	Business plan and management philosophy, existing policy (2015 edition, etc.), organization chart and process flow, management review decisions, policy posting and training records
23	`Management System\Roles and Responsibilities (R&R)`	Review, approve and announce the roles and responsibilities table; update it when the organization is reorganized; training by role	Organization chart, existing roles and responsibilities table and job descriptions, process map, list of projects and sites, status of statutory appointments

Folder names are recommendations. If you already use a folder, specify it as it is. The Company Workspace is where plans, documents and analysis results created by eiso are kept only when you want them kept. Original files (checklists, certificates, name lists, etc.) stay on your computer. Records, measured values and actions that you enter directly in the operating data register are stored encrypted per company in the Company Workspace (eiso server).

Operation steps Expand

Operation steps

The twenty steps in each track are linked to one another: the result of an earlier step becomes the input of the next (for example, issues and requirements from Context of the Organization → compliance obligations in Legal Requirements → Risk Assessment). Choose and click the step you want to proceed with. For a standard with a pass, all 20 steps of that track are available, and you do not pay separately for each step.
You may use a single step on its own; if this is your first time, go in order starting from 1 Context of the Organization. If you use two or more steps, the steps share results. Results kept in this browser (or saved in the Company Workspace) are taken over by other steps. In the Internal Audit step you can also do a virtual audit, a Q&A with an AI auditor.

Economic Prosperity: 20 Steps

Social Value: 20 Steps

Tasks and outputs by step Expand

Step	HS clauses	What you do	Output (example)
Context of the Organization (Operation) Economic Prosperity 1 · Social Value 1	4.1~4.3	Determine the internal and external issues of the organization (including whether climate change is a relevant issue), interested parties and their requirements, and the scope of the management system.	Internal and external issues table (PESTEL, SWOT) Interested parties and requirements table (marking what the management system will address) Scope statement
Legal Requirements Identification Economic Prosperity 4 · Social Value 4	Compliance obligations (e.g. ISO 14001, 45001 6.1.3)	Identify and register the laws and regulations and other requirements the company must comply with (compliance obligations), and set the compliance evaluation plan (method, cycle, evaluator). The actual evaluation is done in the Compliance Evaluation step (Social Value track). Only the names of laws are given, so check provisions and penalties against the original text of the law.	Compliance obligations register: laws and requirements / related activities / person in charge / review cycle Compliance evaluation table Where to check (National Law Information Center, etc.) indicated
Risk Assessment Economic Prosperity 5 · Social Value 5	6.1	Based on the issues and requirements identified in 1 Context of the Organization, determine the risks and opportunities to address, evaluate them with the assessment table suited to the selected standard, and set actions.	Assessment tables by standard: ISO 9001 risks and opportunities, ISO 14001 environmental aspects and impacts, ISO 45001 risk assessment, ISO 37001 bribery risk, ESG double materiality Action plan (action, responsibility, deadline, method of checking effectiveness)
Objective Setting Economic Prosperity 6 · Social Value 6	5.2·6.2	Establish objectives consistent with the policy at relevant functions and levels (departments, ranks), and for each objective plan what will be done, the resources, the responsible person, the completion time and the method of evaluating results.	Draft policy (including commitments by standard) Objectives and key performance indicators (KPI) table: formula, measurement cycle, responsible department, deadline Action plan for achieving objectives
Monitoring and Measuring Equipment Control Economic Prosperity 7 · Social Value 8	7.1 · ISO 9001 7.1.5	Register the instruments used for monitoring and measurement and manage them by setting calibration and verification cycles. If an instrument is found out of calibration, evaluate whether results measured with it are valid.	Measuring instrument register: control no. / equipment / measurement range and resolution / process of use / calibration cycle and body / next calibration date Calibration and verification plan and acceptance criteria Action record when an out-of-calibration finding occurs (evaluation of the validity of earlier measurement results)
Competence Recognition Economic Prosperity 8 · Social Value 9	7.2·7.3	Determine the competence (education, training, experience, qualifications) needed for each job, evaluate whether each person meets it, and recognize their competence. Where it is lacking, close the gap through education and training and check its effectiveness.	Competence criteria table by job: job / education / training / experience / qualifications and licences / method of recognition Competence recognition status table: met or lacking / action / validity period Education and training plan and effectiveness evaluation
Documented Information Control Economic Prosperity 9 · Social Value 10	7.5	Establish the documentation system and numbering, and control the creation, review, approval, distribution, revision and disposal of documents. For records, set storage, protection and retention periods.	List of documents: document number / document title / revision / effective date / owner / distribution Records retention schedule: record / related clause / retention period / storage location and medium / disposal method Flow for preparing, revising and distributing documents, and access rights and backup for electronic documents
Documented Information of External Origin Economic Prosperity 10 · Social Value 11	7.5.3	Identify and register documents received from outside, such as standards, laws, customer drawings and specifications, and supplier materials. Check regularly that they are the latest version, distribute them where needed, and withdraw superseded editions.	List of external documents: document title / issuer / edition or revision date / date received / managing department / method and frequency of latest-version checks / distribution Procedure for checking the latest version (standards, laws, customer portals) Records of receipt, review, distribution and withdrawal
Contract Management Economic Prosperity 11	8.1 · ISO 9001 8.2	Before a quotation, order or contract, determine the customer requirements (statutory requirements, delivery date, quality, special requirements) and review whether they can be met. Contract changes and communication with customers are also controlled.	Contract review checklist: review item / what is checked / result Contract register: contract number / customer / product or service / quantity and delivery date / special requirements / review date / change history Contract change control flow and records of customer communication
Design and Development Control Economic Prosperity 12	8.1 · ISO 9001 8.3	Plan design and development in stages and determine the inputs (requirements). After review, verification and validation, approve the outputs (design results) and control design changes. If design and development are not carried out, state the justification for excluding it from the scope (the reason it may be excluded).	Design and development plan: stage / activity / deliverable / review, verification and validation / responsibility / schedule List of design inputs and outputs, and a template for review meeting minutes Records of design change control
Supplier Management Economic Prosperity 13 · Social Value 12 (supplier and subcontractor management)	8.1 · ISO 9001 8.4	Evaluate and select external providers (suppliers and subcontractors), monitor their performance and re-evaluate them. Also determine how the products and services received will be verified and which requirements are to be communicated to suppliers.	Supplier evaluation and selection criteria: evaluation item / points / pass criterion Approved supplier list: supplier / supplied item / grade / evaluation date / re-evaluation cycle Supplier performance evaluation form, and incoming inspection and verification methods
Process Control Economic Prosperity 14 · Social Value 13 (operational control)	8.1·6.3 · ISO 9001 8.5·8.6	Organize the process flow, and turn the actions determined in risk assessment and legal requirements identification (compliance obligations) into operational control criteria for each process and task (control item, criterion, method, frequency, person in charge, record). This also covers work standards, validation of special processes (processes whose results cannot be fully verified by inspection after production), identification and traceability, and release approval. Planned changes and unintended changes are also controlled (including the former "control plan").	Process flow chart and operational control criteria (QC process chart, control plan): process or task / control item / criterion / method and frequency / person in charge / record / action on abnormality List of work standards, validation plan for special processes, and criteria for identification, traceability and release approval Change control table: review of the consequences of planned and unintended changes
Nonconforming Product Control Economic Prosperity 15	ISO 9001 8.7	Applies only to the Economic Prosperity track (based on ISO 9001). Under the standards of this track (ISO 9001, IATF 16949, ISO 13485, ISO 19443, ISO 22000 and ISO 21001), products and services that do not conform to requirements (nonconforming products) are identified and segregated so that they are not used or delivered unintentionally. Handling such as rework, concession and scrapping, and approval and re-verification, are kept as records. Corrective action to eliminate the cause, and nonconformities under other standards such as environment and occupational health and safety, are dealt with in the Nonconformity and Corrective Action step.	Criteria for handling nonconforming products: type / authority to decide / handling (rework, repair, concession, scrapping, return) / approval / customer notification Nonconforming product register: date of occurrence / process or item / description / quantity / handling / re-verification / whether corrective action is needed Methods of identification and segregation marking
Emergency Preparedness and Response Social Value 14	ISO 14001·45001 8.2	Identify emergency situations such as fire, leaks, explosions, power failure, natural disasters and information leakage, and determine response procedures, communication channels and equipment. Conduct drills regularly and revise the procedures based on the results.	Emergency situation identification table: emergency situation / location or process / potential impact / likelihood / response level Emergency response procedure: initial response / communication channels / equipment and resources / recovery / notification of external bodies Drill plan and evaluation of results
Analysis and Evaluation Economic Prosperity 16 · Social Value 15	9.1	Determine what to monitor and measure, when and how, and analyze the data collected (achievement of objectives, customer satisfaction, processes, suppliers, nonconformities, etc.) to evaluate the performance and effectiveness of the management system.	Monitoring and measurement table: subject / indicator and formula / method / frequency / person in charge / criterion Data analysis results: trends, comparison with objectives, causes Evaluation conclusions and improvement opportunities, and inputs to management review
Compliance Evaluation Social Value 16	ISO 14001·45001 9.1.2	Regularly evaluate, using evidence (materials showing that requirements are being met), whether the legal requirements registered in legal requirements identification and other requirements are actually being met. Take action on those not met and record the compliance status.	Compliance evaluation table: legal or other requirement / summary of requirement / applicable subject / evaluation method / evidence / result (compliant, partially compliant, noncompliant, to be confirmed) / action Compliance evaluation plan: frequency and evaluators Records of actions on noncompliance, and inputs to management review
Internal Audit Economic Prosperity 17 · Social Value 17	9.2	Establish an audit program and audit plan for conducting internal audits at planned intervals, audit using checklists and report the results.	Annual internal audit program and audit plan (scope, criteria, auditors, schedule) Checklists by clause and process Audit report and nonconformity reports
Management Review Economic Prosperity 18 · Social Value 18	9.3	Organize the input materials so that top management reviews the suitability, adequacy and effectiveness of the management system at planned intervals, and record the decisions.	Organization of management review inputs: previous actions, changes in issues and interested parties, performance (objectives, nonconformities, monitoring, audit results), opportunities for improvement Management review report: decisions, needed changes, resources List of follow-up actions
Nonconformity and Corrective Action Economic Prosperity 19 · Social Value 19	10.2	Deal with nonconformities, find and eliminate their causes to prevent recurrence, and verify the effectiveness of the actions.	Nonconformity report (what happened, impact, immediate action) Cause analysis (5 Whys, cause-and-effect diagram) Corrective action plan and records of effectiveness verification
Participation, Consultation and Communication Social Value 7	5.4·7.4	Determine the subjects and methods of participation and consultation by workers and interested parties (occupational safety and health committee, labor-management council, etc.), prepare an internal and external communication plan covering what, when, to whom, how and by whom, and set up channels for raising concerns and reporting, with a ban on retaliation.	Participation and consultation table: matters for consultation (ISO 45001 5.4 d) / matters for participation (5.4 e) / forum and method / frequency / records Internal and external communication plan: what / when / to whom / how / by whom (HS 7.4) Channels for raising concerns and reporting, and handling procedure (ISO 37001 8.9 · ISO 37301 8.3)
Improvement Economic Prosperity 20 · Social Value 20	10.1	Find opportunities for improvement from management review decisions, corrective action results, objective performance and audit observations, judge them in terms of suitability, adequacy and effectiveness, set improvement tasks (person in charge, deadline, resources, performance indicator) and carry them out, verify the effect and standardize, and feed the results back into the context of the organization and objectives of the next cycle. Elimination of the causes of nonconformities is dealt with in the Nonconformity and Corrective Action step.	Improvement judgment table: viewpoint (suitability, adequacy, effectiveness, strategic alignment) / judgment / basis Objective achievement and list of improvement opportunities: source / improvement opportunity / expected effect / priority Improvement task register: task / person in charge / deadline / resources / performance indicator (current → target) / effect verification / status
Policy Establishment Economic Prosperity 2 · Social Value 2	5.1·5.2	Compare the context of the organization, the business direction, the vision of top management and the policy requirements of the selected standards (editions) to establish a management policy for each standard and, if there are two or more standards, an integrated management policy. If an existing policy is in place, analyze the gap against the 2015 edition and propose a revision. Communicate the policy in three stages: declaration, training and monitoring. The Objective Setting step takes over the policy and uses it as the framework for objectives.	Situation analysis report: characteristics of the industry and processes / top 3 key risks / opportunities / relevance to climate change / key requirements of the standard Management policy (per standard and integrated): title / full text of the policy / signature field for top management / date of establishment or revision and applicable standard edition, and a policy comparison table Policy gap analysis and revision proposal (where an existing policy is in place), communication plan for dissemination: declaration and publication / training and internalization / monitoring and feedback
Roles and Responsibilities Economic Prosperity 3 · Social Value 3	5.3	Compare the organization chart, existing roles and responsibilities tables, job descriptions, and process, project and site materials with the requirements of Clause 5 (especially 5.3) of the selected standards (editions), and prepare roles, responsibilities and authorities by department, job, process, project and site, together with a RACI matrix. Map the standard clauses to departments, identify missing responsibilities, overlaps and statutory appointments, and propose improvement tasks. Objectives, risks, competence and internal audit take over these roles and responsibilities.	Roles and responsibilities table (by unit): unit / role (position) / main tasks / responsibility / authority / reporting line / related standard and clause RACI matrix and mapping of standard clauses to departments: task or process / top management / management system manager / R, A, C, I by department 5.3 gap analysis and preparation for statutory appointments: clause / requirement / current status / gap / improvement task / priority

Economic Prosperity Operation: Interrelationship of Steps The inputs and outputs of the 20 steps, shown in figures and diagrams Expand

The 20 steps of Economic Prosperity Operation are not separate functions but one connected management system. The connections are determined on the basis of ISO 9001 (Clause 8, product and service realization) and the requirements of ISO 9001, 14001 and 45001. The result (output) of one step becomes the input of the next, and management review decisions (9.3.3), nonconformities and corrective action (10.2) and analysis results (9.1) feed back to earlier steps to correct the next cycle. In the diagram below, when you select a step, only the inputs it receives (green) and the outputs it sends (blue) are shown, and the reason for each connection (standard clause) appears below.

Input (received by this step)Output (sent by this step)Forward flowFeedback (later step → earlier step)

Select a step by clicking it or by pressing Tab and then Enter, and below you will see where that step receives inputs from and where it sends outputs to.

Overview: the steps each step receives from and sends to

Hover over a number to see what is handed over through that connection and its basis. Orange numbers are feedback (later step → earlier step); selecting a line selects that step in the diagram above.

1 Context of the Organization

←1820

→23456789111718

2 Policy Establishment

←11820

→3689

3 Roles and Responsibilities (R&R)

←121820

→56891417

4 Legal Requirements Identification

←118

→568910111213141718

5 Risk Assessment

←134161819

→6781112131416171819

6 Objective Setting

←123451820

→14161820

7 Monitoring and Measuring Equipment Control

←1516

→141516

8 Competence Recognition

←1234519

→1418

9 Documented Information Control

←1234

→1014

10 Externally Sourced Documented Information

←49

→-

11 Contract Management

←145

→121314151619

12 Design and Development Control

←4511

→1314

13 Supplier Management

←451112

→14151618

14 Process Control

←3456789111213

→151617

15 Nonconforming Product Control

←7111314

→161819

16 Analysis and Evaluation

←56711131415

→57181920

17 Internal Audit

←13451419

→181920

18 Management Review

←14568131516171920

→1234561920

19 Nonconformity and Corrective Action

←51115161718

→58171820

20 Improvement

←616171819

→123618

View in detail as a grid (receiving step × sending step) Expand

Chart: input and output table for the 20 steps of Economic Prosperity

Rows = receiving step, columns = sending step. ● Input received from an earlier step · ◆ Input returned from a later step (feedback). The rightmost column shows the number of inputs received and the bottom row shows the number of outputs sent. Hover over a cell to see the reason for that link (standard clause).

Receiving step ＼ Sending step	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	Number of inputs
Context of the Organization (Operation)																		◆		◆	2
Policy Establishment	●																	◆		◆	3
Roles and Responsibilities	●	●																◆		◆	4
Legal Requirements Identification	●																	◆			2
Risk Assessment	●		●	●												◆		◆	◆		6
Objective Setting	●	●	●	●	●													◆		◆	7
Monitoring and Measuring Equipment Control	●				●											◆					3
Competence Recognition	●	●	●	●	●														◆		6
Documented Information Control	●	●	●	●																	4
Documented Information of External Origin				●					●												2
Contract Management	●			●	●																3
Design and Development Control				●	●						●										3
Supplier Management				●	●						●	●									4
Process Control			●	●	●	●	●	●	●		●	●	●								10
Nonconforming Product Control							●				●		●	●							4
Analysis and Evaluation					●	●	●				●		●	●	●						7
Internal Audit	●		●	●	●									●					◆		6
Management Review	●			●	●	●		●					●		●	●	●		◆	◆	11
Nonconformity and Corrective Action					●						●				●	●	●	●			6
Improvement						●										●	●	●	●		5
Number of outputs	11	4	6	11	11	4	3	2	2	0	6	2	4	3	3	5	3	8	5	5

Social Value Operation: Step Interrelationship Map Inputs and outputs of the 20 steps, shown in figures and charts Expand

The 20 steps of Social Value Operation are not separate functions but one connected management system. The connections are based on ISO 14001 and 45001 (Clause 8 operation and emergency preparedness, 5.4 participation and consultation, 9.1.2 compliance evaluation) and are determined from the requirements of ISO 9001, 14001 and 45001. The result (output) of an earlier step becomes the input of the next step, and management review decisions (9.3.3), nonconformities and corrective actions (10.2) and analysis results (9.1) return to earlier steps to correct the next cycle. In the figure below, select a step to see only the inputs it receives (green) and the outputs it sends (blue); the reason for each connection (clause of the standard) is shown underneath.

Input (received by this step)Output (sent by this step)Forward flowFeedback (later step → earlier step)

Select a step by clicking it or by pressing Tab and then Enter, and below you will see where that step receives inputs from and where it sends outputs to.

Overview: the steps each step receives from and sends to

1 Context of the Organization

←1820

→23456789101718

2 Policy Establishment

←11820

→367910

3 Roles and Responsibilities (R&R)

←121820

→5679101317

4 Legal Requirements Identification

←11618

→56791011121314161718

5 Risk Assessment

←1347151819

→68912131415171819

6 Objective Setting

←1234571820

→13151820

7 Participation, Consultation and Communication

←1234

→56912131417181920

8 Measuring Equipment Control

←1515

→1315

9 Competence and Qualification

←12345719

→131418

10 Documented Information Control

←1234

→1113

11 Externally Sourced Documented Information Control

←410

→-

12 Supplier and Contractor Control

←457

→131518

13 Operational Control

←34567891012

→14151617

14 Emergency Preparedness and Response

←457913

→1519

15 Analysis and Evaluation

←568121314

→5816181920

16 Compliance Evaluation

←41315

→417181920

17 Internal Audit

←13457131619

→181920

18 Management Review

←145679121516171920

→1234561920

19 Nonconformity and Corrective Action

←571415161718

→59171820

20 Improvement

←671516171819

→123618

View in detail as a grid (receiving step × sending step) Expand

Diagram: input and output table for the 20 Social Value steps

Receiving step ＼ Sending step	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	Number of inputs
Context of the Organization (Operation)																		◆		◆	2
Policy Establishment	●																	◆		◆	3
Roles and Responsibilities	●	●																◆		◆	4
Legal Requirements Identification	●															◆		◆			3
Risk Assessment	●		●	●			◆								◆			◆	◆		7
Objective Setting	●	●	●	●	●		◆											◆		◆	8
Participation, Consultation and Communication	●	●	●	●																	4
Monitoring and Measuring Equipment Control	●				●										◆						3
Competence Recognition	●	●	●	●	●		●												◆		7
Documented Information Control	●	●	●	●																	4
Documented Information of External Origin				●						●											2
Supplier Management				●	●		●														3
Process Control			●	●	●	●	●	●	●	●		●									9
Emergency Preparedness and Response				●	●		●		●				●								5
Analysis and Evaluation					●	●		●				●	●	●							6
Compliance Evaluation				●									●		●						3
Internal Audit	●		●	●	●		●						●			●			◆		8
Management Review	●			●	●	●	●		●			●			●	●	●		◆	◆	12
Nonconformity and Corrective Action					●		●							●	●	●	●	●			7
Improvement						●	●								●	●	●	●	●		7
Number of outputs	11	5	7	12	10	4	10	2	3	2	0	3	4	2	6	5	3	8	5	5

Usage example: the inputs and output of a fictional food packaging company handling a customer complaint in "19 Nonconformity and Corrective Action": Operation Step Example (Nonconformity and Corrective Action)

AI management system (ISO/IEC 42001) and information security (ISO/IEC 27001) are operated in the 16 steps of ICT Management System Operation: the target standards of Management System Operation are 12 standards in three groups, Economic Prosperity, Environmental Protection and Social Justice, and ISO/IEC 42001 and ISO/IEC 27001 are not included. ISO/IEC 42001 (and ISO/IEC 27001 if operated together) is operated in the menu ICT Management System Operation Guide, covering context analysis and objectives, AI selection, risk assessment and impact assessment, controls and the Statement of Applicability, verification and approval for use, operational control, documented information control, monitoring, change and revision, internal audit, legal requirements, management review, nonconformity and corrective action, and improvement.

How to use: under "Operate" below, select the standard, industry and step to operate, then specify the folder (or file) for that step on your computer, or enter the situation and materials, and click "Write with AI". The result is produced after the document completeness check (80 points) and can be copied or downloaded as Word. Results of earlier steps carry over to the next steps automatically through result sharing between steps (stored in this browser and in the Company Workspace). If needed, you can also paste content into the "Situation and materials summary" field (content you enter is not stored on the website and is not used for AI training).

Pricing: Management System Operation is a service whose steps are connected as one, so it is not sold by step but used with a pass per standard: TBA for one standard and TBA for each additional standard. For a standard with a pass, you can use all 20 steps of that track, the virtual audit and the nonconformity consultation. No payment is made in advance. When you click "Write with AI", the cost is shown to you, and payment is made if you agree (eiso Pricing).

Output produced by AI is a draft for reference, to be used after your company reviews and approves it. It does not guarantee certification results.
On eiso, AGENT does not artificially prepare or review the documents of a specific company (for implementation consulting and training, separate from eiso, see Management System Establishment and Training Inquiries).

ICT Management System OperationView operation guide in detail Related standards · Scope · Standards operated together · Division of roles · 16 operation steps · Relationship map · Evaluation method Expand

When operating two standards together: choose an operation method ISO/IEC 42001 (AI) · ISO/IEC 27001 (information security)

Choose only when operating ISO/IEC 42001 (AI) and ISO/IEC 27001 (information security) together. If you operate only one standard, you do not need to choose, and the guide below applies as it is. The two standards share the same Harmonized Structure (HS), so they can be operated together or separately for each standard. The operation guide and outputs below differ according to the method you choose. The usage fee is the same under either method.

Integrated operation Default

Uses the 16 steps once for both standards.
The inventory, risk register and operational register are kept as one, with the applicable standard marked on each line.
A statement of applicability is kept separately for each standard, and overlapping controls are implemented once using a correspondence table.
How to use each standard separately is added at the end of the result.

Suitable when: the same scope and the same responsible organization operate both standards together and are audited togetherView as integrated operation ›

Independent operation by standard

Choose one standard at a time and use the 16 steps of that standard.
Documents, registers, statements of applicability and results kept in this browser are separate for each standard.
ISO/IEC 27001 appears with information security names (information asset inventory, information security risk assessment and so on).
The other standard is referred to only through the control correspondence table.

Suitable when: the scope, responsible organization or certification timing differ by standard, or only one standard is operated firstView as independent operation by standard ›

If you do not choose, the integrated operation guide is shown.

ICT Management System Operation GuideOperating (Write with AI) is done on the ICT Management System Operation screen. The standard and industry you select carry over to that screen.

ICT Management System Operation: related standards and operating points

The ICT track operates AI (ISO/IEC 42001) and information security (ISO/IEC 27001) on the basis of the Statement of Applicability (SoA). Both standards follow the harmonized structure (HS) and share the same operating structure: list of targets → risk assessment (6.1.2) → risk treatment, Annex A controls and Statement of Applicability (6.1.3) → operation (clause 8) → monitoring, internal audit and management review. A Statement of Applicability is kept for each standard, and overlapping controls are grouped in a control mapping table and implemented once. Below is the existing guide for this track (scope, standards operated together, division of roles, 16 steps, relationship map, evaluation method), included as it is.

AI steps

Plan (1-6) 1 AI Context Analysis · 2 AI Policy, R&R and Objectives · 3 AI Selection · 4 AI System Inventory · 5 AI Risk Assessment · 6 AI System Impact Assessment
Do (7-11) 7 Control Implementation and Statement of Applicability (SoA) · 8 Verification and Approval for Use · 9 Operational Control · 10 Documented Information Control · 11 Monitoring, Change and Revision Control
Evaluate and improve (12-16) 12 Internal Audit · 13 Legal Requirements and Monitoring · 14 Management Review · 15 Nonconformity and Corrective Action · 16 Improvement

Standard	What it manages	Steps given weight	Requirements specific to the standard to handle at each step (clauses)
ISO/IEC 42001AI	Manages AI risks and the impact on people and society so that AI systems are developed, provided and used responsibly.	1 AI Context Analysis 3 AI Selection 4 AI System Inventory 5 AI Risk Assessment 6 AI System Impact Assessment 7 Control Implementation and Statement of Applicability (SoA) 8 Verification and Approval for Use 9 Operational Control 11 Monitoring, Change and Revision Control 13 Legal Requirements and Monitoring	4.1 AI roles (development, provision, use) and climate change · 6.1.2 AI risk assessment · 6.1.3 Risk treatment and Statement of Applicability (38 Annex A controls) · 6.1.4 AI system impact assessment · 8.2 to 8.4 Risk assessment, treatment and impact assessment during operation · Annex A (A.2 Policies to A.10 Third-party relationships) and Annex B implementation guidance · 9.2 Internal audit · 9.3 Management review
ISO/IEC 27001Information security	Protects the confidentiality, integrity and availability of information assets (including cloud and outsourced).	1 AI Context Analysis 4 AI System Inventory 5 AI Risk Assessment 7 Control Implementation and Statement of Applicability (SoA) 11 Monitoring, Change and Revision Control 12 Internal Audit	4.3 Scope (separately for each standard) · 6.1.2 Information security risk assessment (assign risk owners) · 6.1.3 Risk treatment and Statement of Applicability (93 Annex A controls: 37 organizational, 8 people, 14 physical, 34 technological) · 8.2 and 8.3 Risk assessment and treatment during operation · There is no separate impact assessment clause, so it is handled within risk assessment.

If only ISO/IEC 27001 is selected, the AI-specific steps are used from an information security perspective (3 Selection covers the business processes in scope, 4 Inventory is the list of information assets, 6 Impact assessment is not applicable). The Statement of Applicability is drafted (Rev.0.1) in step 4, finalized in step 7 (approved by top management), and its implementation status is updated in steps 8 to 16.

If both standards are selected, the risk register, internal audit and management review are used as one, and each line states the standard it applies to. Because certification scope and audits are separate for each standard, the Statement of Applicability and the scope document are kept for each standard.

Points often missed

AI is not used before approval for use (8). The approval record is kept in the inventory.
Risks scoring 13 or higher (high or critical) are subject to the step 6 impact assessment and are approved by top management.
Before changing the model, instructions, data or provider, impact review, re-verification and approval are carried out (11).
Overlapping controls are implemented once, and the same evidence is entered in both Statements of Applicability.
For external AI services, the provider contract (data use, retraining, incident notification) is checked as a condition of approval for use.

Clause numbers may differ depending on the edition of the standard. Check them against the text of the standard. Step numbers are the numbers within this track.

Independent operation by standard: each standard is operated separately

The two standards are operated separately. In Operate, if you choose both standards and set the operation method to independent operation by standard, tabs for the operation platform of each standard (ISO/IEC 42001 · ISO/IEC 27001) appear, and each platform uses the 16 steps of that standard separately. If you choose a standard below, the detailed operation steps of that standard are shown.

Outputs and storage: document numbers, registers and statements of applicability are separate for each standard. Step results kept in this browser are also separate for each standard, so the results of one standard do not pass to a step of the other standard.
Between standards: overlapping controls are described in the control correspondence table only as "the same evidence can be used". Correspondence means related, not identical, so check each standard against its original text.
When operating only ISO/IEC 27001: because 6 Impact Assessment has no separate clause, write it briefly as "Not applicable (handled in the risk assessment)". The statement of applicability covers the 93 controls of Annex A.
Usage fee: the same as integrated operation. TBA for the first standard and TBA for each additional standard (1 year from the payment date, excluding VAT).
When switching to integrated operation: if you choose integrated operation above, the two standards are used in one flow. Because the results kept differ by method, paste in the results you need and continue.

Step name comparison (ISO/IEC 42001 ↔ ISO/IEC 27001) Expand

Step	ISO/IEC 42001 operation (AI management system)	ISO/IEC 27001 operation (information security management system)
1	AI Context Analysis	Information Security Context Analysis
2	AI Policy, Roles and Responsibilities, and Objectives	Information Security Objectives
3	AI Selection	Selection of Scope Targets
4	AI System Inventory	Information Asset Inventory
5	AI Risk Assessment	Information Security Risk Assessment
6	AI System Impact Assessment	Impact Assessment (Not Applicable)
7	Control Implementation	Control Implementation and Statement of Applicability
8	Verification and Use Approval	Control Implementation Verification and Approval
9	Operational Control	Operational Register Management
10	Documented Information Management	Documented Information Management
11	Monitoring During Use	Information Security Monitoring and Change Management
12	Internal Audit	Internal Audit
13	Identification and Monitoring of Legal Requirements	Identification and Monitoring of Legal Requirements
14	Management Review	Management Review
15	Nonconformity and Corrective Action	Nonconformity and Corrective Action
16	Improvement	Improvement

View operation steps in detail: choose a standard (this changes together with the platform tabs in Operate)

ISO/IEC 27001 operation guide (independent operation by standard)

The ISO/IEC 27001 (information security management system) operation platform runs on the same 16-step framework as ISO/IEC 42001 operation, but in each step the names, tasks and outputs follow the body of ISO/IEC 27001:2022 and the 93 controls of Annex A. AI selection, AI impact assessment and AI use approval are not used on this platform. The AI instructions on the server follow the same criteria as below.

Scope: organizational, physical and logical boundaries: the scope of the information security management system (4.3) is defined by the boundaries of the organization (departments and sites), physical (buildings and server rooms) and logical (networks, systems and cloud), and also records interfaces and dependencies with other organizations (cloud services, outsourcing and suppliers). For parts left outside the scope, the reasons are recorded. Step 1 Information Security Context Analysis drafts the scope, and step 4 Information Asset Inventory collects the assets within that scope.

One cycle of information security management: identify information assets (step 4) → risk assessment (step 5: designate risk owners) → risk treatment and statement of applicability (step 7: 93 controls, approved by risk owners) → verify control implementation, and approve introduction and changes (step 8) → operational register management (step 9: access rights, backup, logs and patches) → monitoring and information security incident management (step 11) → internal audit (step 12) → management review (step 14) → corrective action and improvement (steps 15 and 16). When a significant change, incident, new threat or legal change occurs, return to step 5 and assess again (8.2).

Usage fee: platform pass TBA for 1 standard, TBA for each additional standard (excluding VAT): counted as the same operation pass as the ISO/IEC 42001 platform. If you choose ISO/IEC 27001 first, it is TBA; if you already have another operation standard, it is TBA. For 1 year from the payment date, you can use all 16 steps (within the daily number of AI writing requests). You do not pay in advance; the cost is shown when you click "Write with AI".

Division of roles: eiso plans, your computer holds basic data, and eiso performs the overall analysis

eiso: Plan	Your computer: actual work and basic data	eiso: processing, analysis and synthesis of information
Creates the plans and criteria for each step, proposed changes to forms and documents (information asset inventory, risk assessment sheet, statement of applicability, operational register), and drafts of tables and checklists.	While doing actual work with the changed forms, your company accumulates basic data (asset list, access rights review, backup test, log review, incident report) on your computer (or in-house server). No separate aggregation or analysis is needed.	When you operate, designate the folder or file of that step; eiso reads it only inside the browser (not stored, not used for AI training), then processes, analyzes and synthesizes it and revises the plans and forms.

Recommended folder structure: what your computer does in each step and the basic data to designate to eiso Expand

Step	Recommended folder	What is done on your computer (basic data)	Materials to designate during operation (analyzed by eiso)
1	`Information Security Management System\01_Information Security Context Analysis`	Organize the list of interested parties and requirements, the list of external dependencies (cloud and outsourcing), and the draft scope	Organization chart, network diagram, list of sites, security clauses in customer contracts, existing ISO documents, previous audit and management review results
2	`Information Security Management System\02_Information Security Objectives`	Have the information security policy and topic-specific policies approved, then publish and distribute them; record indicator results against objectives	Existing policies and objectives, indicator results of the past period, management review decisions
3	`Information Security Management System\03_Selection of Scope Targets`	Collect the information processed, systems and external links for each task and process	Division-of-duties chart, process list, information flow diagram, list of external links
4	`Information Security Management System\04_Information Asset Inventory`	Maintain the information asset inventory (reflecting new and retired assets); confirm owners and classification	Asset management register, system list, cloud contracts, license list
5	`Information Security Management System\05_Information Security Risk Assessment`	Designate risk owners; collect vulnerability inspection and incident records	Information asset inventory, vulnerability inspection results, incident and failure records, previous risk assessment sheet
6	`Information Security Management System\06_Impact Assessment (Not Applicable)`	(Not applicable)	(Not applicable)
7	`Information Security Management System\07_Control Implementation and Statement of Applicability`	Approve the statement of applicability and treatment plan (risk owner); designate those responsible for control implementation	Risk assessment results, existing statement of applicability, list of policies and procedures
8	`Information Security Management System\08_Control Implementation Verification and Approval`	Collect evidence of control implementation (configuration screens, checklists, training records); records of approval of introduction and changes	Evidence of implementation for each control, test and acceptance records, change requests
9	`Information Security Management System\09_Operational Register Management`	Update the operational register; periodic review of access rights; backup restoration tests; patch records	System operation register, access rights list, backup and restoration test records, patch and vulnerability remediation records
10	`Information Security Management System\10_Documented Information Management`	Keep current versions of documents in the 00_Documents folder and treat old versions as obsolete	The entire Information Security Management System\00_Documents folder
11	`Information Security Management System\11_Information Security Monitoring and Change Management`	Log review and indicator measurement records; incident reporting and handling records	Log review records, indicator results, information security incident register, change management records
12	`Information Security Management System\12_Internal Audit`	Confirm the audit schedule and auditors; prepare audit records	Organization chart, statement of applicability, risk assessment results, previous audit results, audit records
13	`Information Security Management System\13_Identification and Monitoring of Legal Requirements`	Maintain the register of legal and contractual requirements; compliance check records	Legal register, security clauses in customer contracts, personal information processing status, compliance inspection records
14	`Information Security Management System\14_Management Review`	Hold the management review meeting; prepare the minutes	9.3.2 inputs (results for indicators, audits, incidents, risks and objectives), status of actions from the previous management review
15	`Information Security Management System\15_Nonconformity and Corrective Action`	Records of corrective action implementation and effectiveness confirmation	Audit findings, incident reports, corrective action register
16	`Information Security Management System\16_Improvement`	Records of implementation and effect confirmation of improvement tasks	Management review decisions, corrective action results, indicator trends

Operation steps Expand

Operation steps

The sixteen steps are connected to one another. The result of an earlier step becomes the input of the next step (for example, information asset inventory → risk assessment → risks requiring treatment → statement of applicability and treatment plan). Choose the step you are going to carry out now and click it. You may use a single step on its own; if this is your first time, proceed in order starting from 1 Information Security Context Analysis. Because this standard has no clause for 6 Impact Assessment, only "Not applicable" is written.

Tasks and outputs by step Expand

Step	Clause	What you do	Output (example)
1 Information Security Context Analysis	4.1 · 4.2 · 4.3 · 4.4 (Amd 1:2024)	External and internal issues (cyber threat trends, dependence on cloud and outsourcing, laws and contracts, technology change, judgment on the relevance of climate change), interested parties and their requirements, which of these the information security management system will address (4.2 c), scope: the boundaries of organization, sites, networks, cloud and outsourcing and the interfaces and dependencies with other organizations (4.3 c), the scope document (draft), and processes and their interactions (4.4).	"Interested parties", "Internal and external issues", "Scope (draft)" (boundaries, interfaces, dependencies, and excluded parts with reasons), "Process map".
2 Information Security Objectives	5.1 · 5.2 · 5.3 · 6.2 · 6.3 · A.5.1 · A.5.2 · A.5.4	Information security policy (draft): checked against a) to d) of 5.2 (appropriate to the purpose of the organization, framework for objectives, commitment to satisfy requirements, commitment to continual improvement) and e) to g) (documented, communicated, available to interested parties), list of topic-specific policies (A.5.1: access control, asset management, cryptography, backup, incident management, suppliers, remote working, acceptable use and so on), roles, responsibilities and authorities (5.3 · A.5.2: information security manager, performance reporting system), no more than 3 information security objectives (6.2: consistent with the policy, measurable, reflecting risk assessment and treatment results, monitored, communicated and updated; achievement plan: what, resources, who is responsible, deadline and evaluation method), and planning of changes to the management system (6.3).	"Information security policy (draft)" (including the 5.2 comparison table), "Topic-specific policies", "Roles, responsibilities and authorities", "Information security objectives and achievement plan".
3 Selection of Scope Targets	4.3 · 4.4 · A.5.12 · A.5.14	For each task and process within the scope, organize the information processed (type, classification level, whether personal information is included), the systems and services used, information transfer routes and external interfaces (customers, suppliers and cloud; A.5.14 information transfer), and the importance of the task and availability requirements, to decide the targets of the information asset inventory and risk assessment. The 6-axis evaluation for AI selection is not used.	"Target tasks and processes".
4 Information Asset Inventory	A.5.9 · A.5.10 · A.5.11 · A.5.12 · A.5.13 · A.5.23 · A.5.34 · 6.1.3	Information and associated assets (information, software, hardware, services (including cloud), people and facilities), one line per asset, with owner (A.5.9), classification (A.5.12: the level criteria are set first), labelling (A.5.13), acceptable use (A.5.10), return (A.5.11), cloud services (A.5.23), and whether personal information is included (A.5.34). Decide whether risk assessment will be done by group of assets. Draft the statement of applicability (Rev.0.1) from the 93 controls of Annex A, making only a first judgment of "applicable / under review / excluded (proposed)" (finalized in step 7).	"Information asset inventory", "Classification criteria", "Draft statement of applicability".
5 Information Security Risk Assessment	6.1.1 · 6.1.2 a)~e) · 8.2	First, risk criteria: a) define the risk acceptance criteria and the criteria for performing assessments (consequence and likelihood scales, level calculation, criteria for requiring treatment); c) identify, for each asset (or scenario), the risks associated with loss of confidentiality, integrity and availability of information within the scope, and determine the risk owner; d) analyse the consequences, likelihood and level; and e) compare them with the acceptance criteria to set treatment priorities. Existing controls (Annex A numbers) are recorded to avoid duplicate treatment, and opportunities (6.1.1) are recorded separately. 8.2: reassess at planned intervals and when significant changes occur.	"Risk criteria" (scale tables and acceptance criteria), the sheet (information security risk assessment, likelihood x impact formula), "Opportunities", and "Summary of risks requiring treatment" (R number, risk owner, level).
6 Impact Assessment (Not Applicable)	(No separate clause. Handled under 6.1.2 d) analysis of results.)	ISO/IEC 27001 has no impact assessment clause. State briefly "Impact assessment: not applicable" with the reason, and where in 5 Risk Assessment the risks with large consequences for people and customers (such as personal information leakage) were addressed. Whether a statutory personal information impact assessment (for public institutions, etc.) applies is "to be confirmed".	"Impact assessment: not applicable" (reason and linked risk R numbers).
7 Control Implementation and Statement of Applicability	6.1.3 a) to f) · 8.3 · Annex A	a) treatment option for each risk (reduce, avoid, transfer, accept); b) determine the necessary controls (from any source); c) compare the determined controls with the 93 controls of Annex A to confirm that no necessary control has been omitted; d) the Statement of Applicability: necessary controls, justification for inclusion (risk R number, law, contract, policy), implementation status, and justification for excluding Annex A controls (one line for each of the 93); e) risk treatment plan; f) approval of the treatment plan and acceptance of residual risks by the risk owners. If your company has provided its decision for each control (applicable or excluded) in the request or in your company materials (a Statement of Applicability file), that decision is the correct answer and the document is written as a final version (Rev.1.0); if not, it is written as a proposed version (Rev.0.x, with the "Customer decision" column left blank). Control numbers and names follow Annex A of ISO/IEC 27001:2022 exactly (to be confirmed if uncertain).	"Statement of Applicability", "Risk treatment plan", "Request for acceptance of residual risks".
8 Control Implementation Review and Approval	8.1 · 8.3 · A.5.8 · A.8.25~A.8.29 · A.8.32	For each control in the treatment plan, determine the evidence and the method of verifying effectiveness to confirm implementation, and judge the result (implemented, partial, not implemented); where insufficient, record the action and deadline. For the introduction of and changes to new systems and services, the approver approves after confirming information security requirements (A.5.8 Information security in project management; A.8.26 Application security requirements), testing and acceptance (A.8.29) and change management (A.8.32). 8.1: processes, products and services provided externally are also subject to control.	"Control implementation check" and "Introduction and change approval record".
9 Operations Register Management	A.5.9 · A.5.15~A.5.18 · A.5.23 · A.8.2~A.8.6 · A.8.8 · A.8.9 · A.8.13 · A.8.15 · A.8.32	Group the operations register of information processing systems and services according to the "operations register classification" (department, division, project, site). For each system, record the owner, granting and periodic review of access rights (A.5.15 to A.5.18; A.8.2 to A.8.5), configuration (A.8.9), capacity (A.8.6), backup and restore testing (A.8.13), log retention (A.8.15), technical vulnerabilities and patches (A.8.8), cloud services (A.5.23), change history (A.8.32) and the next review date. If a register already exists, keep its numbers and write "Updates in this revision". The revision numbering rule Rev.N.M is the same as for the ICT operations register.	"Operations register", "Access rights review", and "Check results" (review deadline passed, backup not tested, etc.).
10 Documented Information Management	7.5.1 · 7.5.2 · 7.5.3 · A.5.37	Without writing new documents, organize the document list, old versions and duplicates using the current versions in your company folder (Information Security Management System\00_Documents), and check the documented information required by ISO/IEC 27001: 4.3 scope, 5.2 policy, 6.1.2 risk assessment process, 6.1.3 risk treatment process, 6.1.3 d) Statement of Applicability, 6.1.3 e) treatment plan, 6.2 objectives, 7.2 evidence of competence, 7.5.1 b) documented information determined by the organization as necessary, 8.1 operational planning and evidence of controls, 8.2 risk assessment results, 8.3 treatment results, 9.1 monitoring and measurement results, 9.2 audit program and results, 9.3 management review results, and 10.2 nonconformities and corrective actions; plus the documents required by controls marked "applicable" in the Statement of Applicability (documented operating procedures A.5.37, etc.). Missing documents are referred to "to be prepared in Management System Establishment".	"Document list" (current Rev, approval date, owner, retention), "Check of required documented information", and "Reference documents by process" (for each of the 16 steps).
11 Information Security Monitoring and Change Management	9.1 · A.5.7 · A.5.24~A.5.28 · A.6.8 · A.8.8 · A.8.15 · A.8.16 · A.8.32	9.1: determine what is to be monitored and measured, the methods, when, by whom, and when the results are analysed and evaluated and by whom (information security performance and effectiveness of the management system), and analyse the results. Information security incident management: reporting (A.6.8) → assessment and decision (A.5.25) → response (A.5.26) → evidence collection (A.5.28) → lessons learned (A.5.27), with planning and preparation (A.5.24). Logging (A.8.15), monitoring activities (A.8.16), change management (A.8.32), technical vulnerabilities (A.8.8) and threat intelligence (A.5.7). Only incidents that are nonconformities are passed to 15. Statutory reporting and notification deadlines are "to be confirmed".	"Measurement indicators", "Information security incident register" and "Change management records".
12 Internal Audit	9.2.1 · 9.2.2 (see ISO 19011 and ISO/IEC 27007)	The audit program (frequency, methods, responsibilities, planning requirements and reporting, reflecting the results of previous audits); the criteria and scope of each audit; selection of auditors (objectivity and impartiality, no auditing of one’s own work); a checklist for each unit (main clauses 4 to 10 plus the Annex A controls marked "applicable" in the Statement of Applicability: excluded controls are not asked about; see ISO/IEC TS 27008 for control assessment); and the tracing sequence (risk assessment → treatment plan and Statement of Applicability → evidence of control implementation: access rights reviews, backup restore tests, logs, patches, incident handling records). Reports are written only from actual audit records.	"Audit program", "Checklist by department", and, for a report, "Findings" (recording the main clause and Annex A together).
13 Legal Requirements Identification and Monitoring	4.2 · A.5.31 · A.5.32 · A.5.33 · A.5.34 · A.5.35 · A.5.36	Identify legal, regulatory and contractual requirements (A.5.31) and record them in a register: personal information protection, information and communications network and cyber intrusion response, notices on electronic finance and cloud (given as information security and personal information results; only statute names are stated, and articles and effective dates are to be confirmed), contractual security requirements (customer security pledges, SLAs, cloud terms), intellectual property rights (A.5.32), protection of records (A.5.33) and privacy and protection of PII (A.5.34). Compliance checks: compliance with policies, rules and standards (A.5.36) and independent review of information security (A.5.35). AI regulations are outside the scope of this standard and are not recorded (if your company uses AI, they are covered under ISO/IEC 42001 operation).	"Register of legal and contractual requirements", "Compliance check" and "Changed regulations and action plan".
14 Management Review	9.3.1 · 9.3.2 a)~g) · 9.3.3	9.3.2 inputs: a) status of actions from previous management reviews; b) changes in external and internal issues; c) changes in the needs and expectations of interested parties; d) information security performance (nonconformities and corrective actions, monitoring and measurement results, audit results, fulfilment of information security objectives); e) feedback from interested parties; f) results of risk assessment and status of the risk treatment plan; g) opportunities for continual improvement. Summarize each item ("insufficient" if none). 9.3.3 results: document decisions on opportunities for improvement and any need for changes to the management system.	"Management review inputs" (a to g), "9.3.3 decisions" and "Follow-up action register".
15 Nonconformity and Corrective Action	10.2 a)~g) · A.5.27	For each nonconformity: a) reaction (control and correct it, deal with the consequences); b) evaluate the need for action to eliminate the cause (review, root cause, similar nonconformities); c) implement the action; d) review its effectiveness; e) change the management system if necessary; and document it. Distinguish information security incidents from nonconformities (not every incident is a nonconformity), and feed lessons learned from incidents (A.5.27) back into updates of the risk assessment (5) and the Statement of Applicability (7). Record the main clause and the Annex A control together in the findings.	"Nonconformity and corrective action register".
16 Improvement	10.1 · 9.3.3	Continually improve the suitability, adequacy and effectiveness of the information security management system: collect improvement opportunities (management review decisions, audit observations, incident trends, threat trends, technology changes) as tasks and link them to the information security objectives (6.2). Do not mix this with eliminating the causes of nonconformities (corrective action).	"List of improvement opportunities", "Improvement task register" and "Proposal for next-year operation and objective adjustments".

ISO/IEC 27001 Operation Step Relationship Map View the inputs and outputs of the 16 steps as figures and tables Expand

This shows what the 16 ISO/IEC 27001 operation steps pass to one another. The risks requiring treatment and risk owners from risk assessment (5) go to the Statement of Applicability and treatment plan (7), legal and contractual requirements (13) go to the Statement of Applicability as the justification for inclusion, and the results of incidents, audits and management review return to earlier steps to correct the next cycle. 6 Impact Assessment has no clause in this standard and therefore has no connections.

Show 10 reference document links

Input (received by this step)Output (sent by this step)Forward flowFeedback (later step → earlier step)10 Documented Information Management → reference documents for each step

Select a step by clicking it or by pressing Tab and then Enter, and below you will see where that step receives inputs from and where it sends outputs to.

Overview: the steps each step receives from and sends to

Hover over a number to see what is passed through that connection and its basis. Orange numbers are feedback (later step → earlier step), and clicking a number selects that step in the diagram above. Every step receives the reference documents (current versions) of 10 Documented Information Management (omitted in the table).

1 Information Security Context Analysis

←131416

→23457101314

2 Information Security Objectives

←1451112141516

→3571011121416

3 Selection of Target Operations

←124916

→45

4 Information Asset Inventory

←13

→23589101213

5 Information Security Risk Assessment

←12341113141516

→27891011121415

6 Impact Assessment (Not Applicable)

←-

→-

7 Control Implementation and Statement of Applicability

←12513141516

→891011121315

8 Control Implementation Verification and Approval

←457

→91011

9 Operations Register Management

←4578

→3101112131416

10 Documented Information Management

←1245789

→All steps

11 Information Security Monitoring and Change Management

←25789

→251213141516

12 Internal Audit

←245791115

→2141516

13 Legal Requirements Identification and Monitoring

←147911

→157141516

14 Management Review

←12591112131516

→12571516

15 Nonconformity and Corrective Action

←5711121314

→257121416

16 Improvement

←291112131415

→1235714

View in detail as a grid (receiving step × sending step) Expand

Diagram: input and output table of the 16 steps of ISO/IEC 27001

Row = receiving step, column = sending step. ● Input received from an earlier step · ◆ Input returned from a later step (feedback) · ▪ Reference document of Step 10 Documented Information Management. Hover over a cell to see what is passed on and the supporting clause.

Receiving step ＼ Sending step	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	Number of inputs
1 Information Security Context Analysis										▪			◆	◆		◆	4
2 Information Security Objectives	●			◆	◆					▪	◆	◆		◆	◆	◆	9
3 Scope Selection	●	●		◆					◆	▪						◆	6
4 Information Asset Inventory	●		●							▪							3
5 Information Security Risk Assessment	●	●	●	●						▪	◆		◆	◆	◆	◆	10
6 Impact Assessment (Not Applicable)																	0
7 Control Implementation and Statement of Applicability	●	●			●					▪			◆	◆	◆	◆	8
8 Control Implementation Verification and Approval				●	●		●			▪							4
9 Operations Register Management				●	●		●	●		▪							5
10 Documented Information Management	●	●		●	●		●	●	●								7
11 Information Security Monitoring and Change Management		●			●		●	●	●	▪							6
12 Internal Audit		●		●	●		●		●	▪	●				◆		8
13 Legal Requirements Identification and Monitoring	●			●			●		●	▪	●						6
14 Management Review	●	●			●				●	▪	●	●	●		◆	◆	10
15 Nonconformity and Corrective Action					●		●			▪	●	●	●	●			7
16 Improvement		●							●	▪	●	●	●	●	●		8
Number of outputs	8	8	2	8	9	0	7	3	7	14	7	4	6	6	6	6

Evaluation method (common to all steps) Expand

Risk criteria (6.1.2 a): Risk acceptance criteria and criteria for performing risk assessments are set first in Step 5 and used by every step. If your organization has no criteria, use this example: consequence (impact, 1 to 5) × likelihood (1 to 5) = 1 to 25; 1 to 6 low · 7 to 12 medium · 13 to 19 high · 20 to 25 critical; 6 or below is accepted, 7 or above requires treatment.
Judging consequence (impact): Consider the effect of a loss of confidentiality, integrity and availability on the business, legal requirements, customers and reputation separately, and use the highest value (state which attribute it is).
Risk identification method: Use either an asset-based method (assets · threats · vulnerabilities) or a scenario-based method, whichever suits your organization. The standard does not prescribe a method (see ISO/IEC 27005:2022). Record existing controls to avoid duplicated treatment.
Risk owner (6.1.2 c): Assign for each risk a person with the responsibility and authority to manage it. The risk owner approves the treatment plan and accepts the residual risk (6.1.3 f).
Treatment options: reduce (apply controls) · avoid (stop the activity) · transfer (insurance, outsourcing contract) · accept.
Statement of Applicability (6.1.3 d): One line for each of the 93 Annex A controls (organizational A.5: 37 · people A.6: 8 · physical A.7: 14 · technological A.8: 34): the control needed, the justification for inclusion (risk number, law, contract, policy), implementation status, and the justification for exclusion. For control attributes (preventive, detective, corrective; confidentiality, integrity, availability), see ISO/IEC 27002:2022.
Information classification (A.5.12): Example: public · internal · confidential · top secret. If your organization has classification criteria, use them. The classification level determines labelling (A.5.13), transfer (A.5.14) and access rights (A.5.15).
Triggers for reassessment (8.2): planned intervals (at least once a year is recommended), significant changes (systems, organization, suppliers), information security incidents, new threats or vulnerabilities, changes in laws or contracts.
Audit judgement: conformity · observation · minor nonconformity · major nonconformity. Record both the main clause and the Annex A control in each finding.

Operate on the ISO/IEC 27001 Operation Platform ›

ISO/IEC 42001 operation steps in detail (operated independently for each standard)

The scope, the 16 operation steps, the relationship diagram and the evaluation method below are guidance for the ISO/IEC 42001 (AI management system) operation platform. They are not mixed with ISO/IEC 27001 documents and ledgers. Go to the ISO/IEC 42001 Operation Platform ›

Scope: development · provision · use: the scope of an AI management system is broadly divided into development, provision and use. If you select it (multiple selections allowed) before the operation steps under Operate on the ICT Management System Operation screen, the selected scope applies to all 16 steps. The scope statement (4.3), AI inventory, priority risks, Annex A controls, items requiring approval, monitoring, change and revision control, and internal audit are all tailored to the selected role. Each step page has a table of "what to do in this step, by scope".

Development	Supply	Use
Design, develop, train and test AI systems and models (in-house development, development commissioned by customers)	Provide AI products and services to customers (selling in-house products, integrating and reselling external AI)	Use external or in-house AI in work and projects (generative AI, vision inspection, prediction models, etc.)

Standards operated together: based on the Statement of Applicability (SoA)

ISO/IEC 42001 and ISO/IEC 27001 both follow the Harmonized Structure (HS) and have the same operating structure: list of targets → risk assessment (6.1.2) → risk treatment, Annex A controls and Statement of Applicability (6.1.3) → operation (Clause 8) → monitoring, internal audit and management review. So if you also choose ISO/IEC 27001 under "Standards to operate", the 16 steps run as one flow.

Keep a separate Statement of Applicability for each standard, because certification scope and audits are separate for each standard (ISO/IEC 42001 Annex A: 38 controls; ISO/IEC 27001:2022 Annex A: 93 controls).
Overlapping controls are grouped in a control mapping table and implemented once, and the same evidence is recorded in both Statements of Applicability. A mapping means "related", not "identical", so compare the depth of requirements of each standard against the original text.
The output of Step 7 Control Implementation and Statement of Applicability includes the control mapping table and a Statement of Applicability sheet for each standard. The risk register, internal audit and management review are kept as one, with the applicable standard stated on each line.
The usage fee is charged for each standard: TBA for one standard, and TBA for each additional standard (excluding VAT).

Control mapping table (ISO/IEC 42001 Annex A ↔ ISO/IEC 27001:2022 Annex A) Expand

ISO/IEC 42001 control	Content	ISO/IEC 27001:2022 Annex A (related controls)
A.2.2	AI policy	A.5.1 Policies for information security
A.3.2	AI roles and responsibilities	A.5.2 Information security roles and responsibilities · A.5.3 Segregation of duties
A.3.3	Reporting of concerns	A.6.8 Information security event reporting
A.4.2~A.4.6	Documentation of AI system resources (data, tools, computing, people)	A.5.9 Inventory of information and other associated assets · A.5.12 Classification of information · A.6.3 Information security awareness, education and training
A.5.2~A.5.5	AI system impact assessment (individuals, groups, society)	— (in the 6.1.2 risk analysis)
A.6.1.2·A.6.1.3	Objectives and processes for responsible development	A.8.25 Secure development life cycle · A.8.27 Secure system architecture and engineering principles
A.6.2.2·A.6.2.3	AI requirements and design	A.5.8 Information security in project management · A.8.26 Application security requirements
A.6.2.4	Verification and validation	A.8.29 Security testing in development and acceptance
A.6.2.5	Deployment	A.8.31 Separation of development, test and production environments · A.8.32 Change management
A.6.2.6·A.6.2.8	Operation, monitoring and event logs	A.8.15 Logging · A.8.16 Monitoring activities
A.6.2.7	Technical documentation	A.5.37 Documented operating procedures
A.7.2~A.7.6	Data (development, acquisition, quality, provenance, preparation)	A.5.12 Classification of information · A.5.34 Privacy and protection of PII · A.8.11 Data masking · A.8.33 Test information
A.8.2	System documentation and information for users	—
A.8.3·A.8.4	External reporting and incident communication	A.5.24 to A.5.26 Incident management · A.5.5 Contact with authorities
A.8.5	Provision of information to interested parties	A.5.5 Contact with authorities · A.5.6 Contact with special interest groups
A.9.2~A.9.4	Responsible use and intended use	A.5.10 Acceptable use of information and other associated assets
A.10.2	Allocation of responsibilities (third parties)	A.5.19 Information security in supplier relationships · A.5.20 Addressing information security within supplier agreements
A.10.3	Suppliers	A.5.19 to A.5.23 Suppliers, ICT supply chain and cloud services
A.10.4	Customers	A.5.20 Addressing information security within supplier agreements (agreements with customers)

One cycle of AI management: for each task, project and division: select the AI needed (Step 3) → risk assessment (Step 5; impact assessment in Step 6 for high risk) → controls (SoA and human oversight, Step 7) → use approval (Step 8: not used before approval) → monitoring during use → change control (before changing the model, instructions, data or supplier: impact review, revalidation and approval) → revision control (versions and revision history of the inventory, risk assessment sheet, SoA, guidelines and model) (Step 11). When a trigger for reassessment (change, incident, legislation) arises, return to Step 5.

Usage fee: platform pass TBA for one standard, and TBA for each additional standard (excluding VAT): For each standard chosen, you use all 16 steps for one year from the payment date (within the daily number of AI writes). It is counted together with Management System Operation: if you already have a Management System Operation standard, an ICT standard costs TBA; if the first standard ends first and only additional standards remain, an additional TBA is charged on the additional standard chosen first to convert it to the base standard. No payment is made in advance. When you press "Write with AI", the cost is shown; if you agree, you pay on the spot and then continue writing.

Division of roles: eiso plans, your computer holds basic data, and eiso performs the overall analysis

eiso: Plan	Your computer: actual work and basic data	eiso: processing, analysis and synthesis of information
Creates plans and criteria for each step, form and document change proposals (AI system inventory, risk assessment sheet, Statement of Applicability, guidelines), and drafts of tables and checklists.	Do your actual work with the changed forms, and accumulate basic data (AI list, assessment results, test records, monitoring logs, incident reports) on your own computer (or in-house server). You do not need to compile or analyse it separately.	When you operate, designate the folder or file of that step; eiso reads it only inside the browser (not stored, not used for AI training), then processes, analyzes and synthesizes it and revises the plans and forms.

Recommended folder structure: what your computer does in each step and the basic data to designate to eiso Expand

Step	Recommended folder	What is done on your computer (basic data)	Materials to designate during operation (analyzed by eiso)
1	`AI Management System\01_AI Context Analysis`	Compile a list of interested parties (name, internal/external, expectations, related laws and contracts), a list of AI systems (name, intended purpose, development, purchase, use, affected parties), and a draft AIMS scope	This year's business plan, previous year's management analysis and KPI results, material on strengths and weaknesses, customer requirements and AI clauses in contracts, organization chart, existing ISO documents, internal audit and management review results
2	`AI Management System\02_AI Policy, Roles and Responsibilities, and Objectives`	Obtain approval for the AI policy and AI objectives, publish and distribute them, and record the results of the objective indicators (monthly, quarterly) in the designated form	Business plan, existing AI policy and objectives, KPI results of the past period, management review decisions (results of earlier steps are carried over automatically through step sharing in this browser)
3	`AI Management System\03_AI Selection`	Gather, for each project, department, division and process, the work and its current bottlenecks and the tasks for which you want to use AI	Division of duties table, organization chart, project list, process map, information classification criteria, list of AI currently in use (operation control ledger)
4	`AI Management System\04_AI System Inventory`	Register every AI service, subscription and in-house model without omission, and correct the entries when they change	List of AI services and subscriptions, system configuration diagram and data flow, previous inventory
5	`AI Management System\05_AI Risk Assessment`	Keep the division of duties table, project (AI task) list and organization chart up to date, carry out risk treatment actions, and record errors and incidents	Division of duties table, project (AI task) list, organization chart, previous risk assessment ledger, generative AI usage guidelines and current Statement of Applicability, error and incident records, supplier information
6	`AI Management System\06_AI System Impact Assessment`	Carry out mitigation actions and conduct bias and performance tests	Risk assessment results, bias and performance test results, privacy impact assessment material, opinions of interested parties
7	`AI Management System\07_Controls and SoA`	Reflect the controls in in-house guidelines and procedures, and keep records of implementation	Step 5 risk assessment results (retrieved automatically in this browser), current Statement of Applicability, in-house AI guidelines, AI clauses in contracts, list of legal requirements, competence criteria by job
8	`AI Management System\08_Verification and Use Approval`	Carry out testing and validation, and keep use approval and dataset records	Testing and validation records, use approval records, dataset list and provenance material
9	`AI Management System\09_Operational Control`	Keep the master ledger on your own computer (or in-house server), correct the relevant line at every approval, distribution and change, and store the original text of prompts by version in the designated folder	AI operation control ledger currently in use (Excel), results of Steps 4 to 8 and approval records, list of prompts and programs
10	`AI Management System\10_Documented Information Management`	Keep the manuals, procedures, guidelines and forms received from Management System Establishment as current versions in the AI Management System\00_Documents folder, move old versions to the obsolete folder beneath it, and fill in the document number, Rev. and approval fields on the cover	The entire AI Management System\00_Documents folder, the previous document list, the list of documents of external origin (standards, laws, supplier documents)
11	`AI Management System\11_Monitoring, Change and Revision`	Measure the indicators and collect logs, and record change requests, revision history, incidents and training	Monitoring logs and indicator values, change requests and approvals, revision history, incident reports, training completion records
12	`AI Management System\12_Internal Audit`	Carry out the audit, and record the checklist results, evidence and findings	Organization chart, division of duties, AI certification scope, status of AI utilization tasks, AI policy, Statement of Applicability, risk and impact assessment results, document list, previous audit results and audit records
13	`AI Management System\13_Legal Requirements Identification and Monitoring`	Accumulate records of legal checks and implementation records (notice, consent, training, impact assessment), and update the register every half year	Previous AI legal requirements register, implementation records and evidence (notice screens, consent records, training records, impact assessment reports), contracts, terms of use, DPA, in-house AI guidelines
14	`AI Management System\14_Management Review`	Hold the management review meeting and carry out the decisions	Summary of the results of each step, minutes of the previous management review, status of corrective actions, performance indicators
15	`AI Management System\15_Nonconformity and Corrective Action`	Carry out corrective actions, and record the supporting evidence and the results of effectiveness checks	Internal audit report and findings (results of Step 12 are carried over automatically), Step 13 legal compliance check results, incident reports, previous corrective action records
16	`AI Management System\16_Improvement`	Carry out improvement tasks and record the effect (indicators before and after)	Management review decisions, corrective action results, observations and improvement recommendations, trend of monitoring indicators, opinions of interested parties

Operation steps Expand

Operation steps

The sixteen steps are linked to one another. The output of an earlier step becomes the input of the next (for example: AI system inventory → risk assessment; high risk of 13 points or more → impact assessment → Statement of Applicability). Choose and press the step you want to carry out now. You may use a single step on its own; if you are starting, go in order from 1 AI Context Analysis. If you use two or more, the results stored in this browser are carried over to the other steps.

Tasks and outputs by step Expand

Step	Clause	What you do	Output (example)
1 AI Context Analysis	4.1~4.4	Covers Clause 4 (context of the organization) of ISO/IEC 42001 in one output: interested party analysis (4.2, with separate rows for those affected by AI) → external issues PESTEL and internal issues (4.1) → SWOT and cross strategies (with traceable source IDs) → strategy action plan (priority, KPI, owner, deadline, budget, funding) → CEO and CFO review → linkage table to 6.1, 6.2 and 9.3. If your organization enters the interested parties directly, they are used as they are and only the blanks are supplemented; if left blank, a general list (organization to confirm) is used. External trends and AI trends for your industry are researched on the web (with sources and reference date), and internal strengths and weaknesses are taken only from your organization's materials. Only the sections of the analysis methods you choose (SWOT, PESTEL, 7M) are written.	Interested party analysis table (ID, AI role, needs, expectations, related requirements, whether addressed by the AIMS, impact × interest management strategy, monitoring, linked clauses), entered directly or from the general list PESTEL, internal issues (ID, basis, reference date), SWOT (source IDs), cross strategies (SO, ST, WO, WT), strategy action plan, CEO and CFO review; the main tables are also provided in Excel Judgement on the relevance of climate change (AI computing energy and carbon), linkage table (6.1 risks and opportunities → 5 AI Risk Assessment, 6.2 AI objectives, 9.3 management review inputs), review, approval and revision cycle, and items to be confirmed
2 AI Policy, Roles and Objectives	5.1·5.2·6.2	Based on the results of 1 AI Context Analysis, 4 AI System Inventory, 5 AI Risk Assessment, 6 AI System Impact Assessment, 12 Internal Audit and 15 Nonconformity and Corrective Action, and on the folders and files you designate (business plan, existing policy, objectives, KPI results), the AI policy (5.2) and AI objectives (6.2) are set. Objectives are chosen with emphasis on effectiveness and efficiency, no more than three, and for each objective the indicator, target value and achievement plan (what will be done, resources, responsibility, completion date, evaluation method) are set. The output is one Word document in the standard format, "AI Policy and AI Objectives", and by OBJ number it is carried over by 3 Selection, 5 Risk Assessment, 7 Controls, 11 Monitoring, 14 Management Review and 16 Improvement.	"AI Policy and AI Objectives" Word document: cover (document number, Rev., prepared, reviewed, approved), purpose, scope and related documents, AI policy (checked against 5.2 a) to d)) No more than three AI objectives (OBJ · effectiveness/efficiency · Annex C · source step ID · indicator, baseline and target values · frequency · responsibility · deadline) and the objective achievement plan, linkage between objectives and processes Monitoring and reporting, communication and awareness, candidate objectives not chosen and the reasons, revision history and items to confirm
3 AI System Selection	4.1·6.1·8.1	From the designated folders and uploaded files (division of duties table, organization chart, project list, process map), all work within the scope (including customary work) is identified by project, department, division and process; P1, P2 and P3 are set on six axes (repetition frequency, judgement difficulty, cost of error, data confidentiality level, AI impact, need for human oversight); and only work at or above the criterion score is selected using the selection criteria (100 points: repetition frequency, judgement difficulty, expected effect, cost of error, confidentiality level, existing AI use). For each selected task, AI already in operation is looked for first and applied in the order of extending as is → reusing a derivative → new development, and the introduction priority and schedule (batch, start, completion, owner) are drawn up. The output is the Excel "AI Selection Table" maintained by unit; only the selected tasks become the input of 4 Inventory (5 Risk Assessment takes over from the inventory), and when work or practices change, upload that file to update it (change history).	Excel "AI Selection Table": task list (division of duties) · AI six-axis evaluation · review of existing AI use · introduction priority · schedule sheets Order of promotion: P1 extend as is → P1 reuse derivative → P2 extend as is → P1 new development → P2 derivative and new, P3 on hold Monthly promotion schedule and promotion system (check of existing AI utilization rate and completion rate) → input to Step 4
4 AI System Inventory	4.3·A.4·A.6	Register the AI systems you use (or plan to use) together with purpose, AI role, supplier, model, input data, parties affected by output and scope of use (LEVEL 1 individual to 4 company-wide), and determine the assessment type (excluded, simplified, full) and scope. Using the inventory and the chosen scope (AI role), a draft Statement of Applicability (Rev.0.1) with the first-pass applicability of the 38 Annex A controls is prepared together, so that 5 Risk Assessment selects controls on this basis. Centering on the tasks selected in Step 3, the AI systems and tasks in use or planned are registered with purpose, AI role, supplier, model, input data, parties affected by output and scope of use (LEVEL 1 to 4); with the assessment criteria your organization has reviewed, the assessment type (full, simplified, excluded) and scope are set, and passed on as input to 5 Risk Assessment, 6 Impact Assessment and 7 Statement of Applicability.	AI system inventory: purpose / role / supplier and model / data / affected parties / LEVEL / assessment type and basis / status Scope judgement: inclusion or exclusion and basis Missing information and items to confirm
5 AI Risk Assessment	6.1.2·6.1.3·8.2·8.3	Taking the Step 4 AI System Inventory as input, every AI system and task whose assessment type is full or simplified and that falls within the scope is assessed without omission. The assessment type (full, simplified, excluded) is set, risks in six categories (cause → event → consequence) are assessed by likelihood × severity (1 to 25, with the severity axis noted), and the treatment option, basis controls, comparison with the Statement of Applicability and the risk level after treatment are set. The results become the input of 6 Impact Assessment and 7 Control Implementation and Statement of Applicability.	Reconciliation summary (input N = assessed M + excluded K) and consolidated register; for each task: assessment unit · LEVEL · assessment type · highest risk · risk level · grade · impact assessment · reassessment trigger Risk details and treatment plan (Excel): cause → event → consequence / 23894 source and objective / severity axis / treatment option · basis controls · comparison with the Statement of Applicability / risk level after action Targets of impact assessment (to Step 6) · linkage to the Statement of Applicability (to Step 7) · auditor-perspective self-check (NC and OFI candidates)
6 AI System Impact Assessment	6.1.4·8.4·A.5	Assesses the impact of high-risk AI systems (13 points or more) on individuals, groups and society in seven areas (safety, fairness, transparency, privacy, security, human oversight, society and environment), and determines approval, conditional approval or hold, and the deployment conditions.	AI system impact assessment report: for each of the seven areas high / medium / low / basis / affected people and groups / mitigation actions Overall judgement (approval, conditional approval, hold) and deployment gate conditions Notice to interested parties and plan for gathering opinions
7 Control Implementation and Statement of Applicability (SoA)	6.1.3 · Annex A and B	Taking the Step 5 risk assessment results (basis controls and comparison with the Statement of Applicability in the treatment plan) as input, the Annex A controls chosen in risk treatment are justified in the Statement of Applicability (SoA), and human oversight (authority to review, intervene and override), legal requirements and compliance obligations, and resources and competence for AI systems are designed. By combining the Step 4 draft Statement of Applicability, the basis controls of the Step 5 treatment plan and the Step 6 impact assessment mitigation actions, all 38 controls are finalized (Rev.1.0, approved by top management), and Steps 8 to 16 add implementation status and evidence to this finalized version.	Statement of Applicability (SoA): for each Annex A area (A.2 to A.10), reasons for applying or excluding / implementation method / related documents and records Human oversight design table: oversight method / person with override authority / point of intervention / route for reporting concerns List of legal requirements and compliance obligations, plan for resources and competence (targets of awareness training)
8 Verification and Use Approval	8.1·A.6·A.7	Through review, verification and validation (V&V), it is confirmed that the AI fits the requirements and intended use, and after confirming control implementation, the approver for the grade approves use (not used before approval; for high risk, after the impact assessment is complete). Controls by life cycle stage and the management of training and operation datasets are also set.	Use approval record: applicable task, project and division / risk level / impact assessment / control implementation / V&V results / approval conditions and use restrictions / approver / next reassessment Plan for review, verification and validation, and deployment gate criteria Table of controls by life cycle stage, and register of training and operation datasets
9 Operational Control	7.5·8.1·A.4·A.6·A.9	Approved AI use programs (instructions and prompts, custom GPTs, automations, API integrations, in-house models) are gathered company-wide in one AI operation control ledger. Your organization chooses how to divide the ledger (by department, division, project or site, or by direct entry); each program is given a number and version, and the important content of every stage of the life cycle is linked in one line: registration → risk assessment → control method → review → approval → deployment → monitoring → change history → suspension and disposal. We either compile the ledger from the results of Steps 4 to 8, or, if you designate the ledger file you use, reflect the new results and produce an updated version (Excel).	AI operation control ledger (Excel): summary sheet / program register (category, number, version, status) / risks and controls / review and approval / deployment / monitoring / change history / code table Ledger operating rules: master owner, update timing (approval, deployment, change, incident), how to assign versions, location for storing original prompts List of blank fields, use before approval and items needing reassessment, and next actions
10 Documented Information Control	7.5	Manuals, procedures, guidelines and forms are created in eiso's "Management System Establishment" and kept in the designated folder on your computer (recommended: AI Management System\00_Documents). This step reads that folder to build a document list, identifies the latest version (current version) among several versions of the same document and organizes the revision history, and tells you the related reference documents for each of the 16 step processes. It does not write new documents; missing mandatory documents are passed on to Management System Establishment to be written.	AIMS document list (Excel): document number · name · type · current Rev. · revision date · approval · file location · related process · status (current · approval to be confirmed · inconsistent notation) / cleanup of old and duplicate files Reference documents by process: for each of Steps 1 to 16, the procedures, guidelines and forms that serve as the basis for that work (number, current Rev.), check of mandatory documented information (7.5.1), list of documents of external origin Revision history, rules for documented information management, and items to be written in Management System Establishment
11 Monitoring, Change and Revision Control	9.1·7.5·A.6·A.8·A.9	While approved AI is in use, important risks are monitored by indicators and thresholds (including performance degradation); change control, with impact review, revalidation and approval when changing the model, instructions, data, supplier or use; revision control of the inventory, risk assessment sheet, SoA, guidelines and model versions; and incident response and AI awareness training are operated. Monitoring results and change history are recorded in succession in the Step 9 operation control ledger.	Status of approved AI use and monitoring table of important risks: indicator / measurement method and log / frequency / alert criteria / action to take when exceeded Change control records and revision control ledger (version, revision date, reason, reassessment needed, approval) Incident response procedure and AI awareness training plan
12 Internal Audit	9.2 · Annex A	If you designate folders or files for the organization chart, division of duties, AI certification scope, AI utilization tasks, AI policy, Statement of Applicability (SoA), risk and impact assessment results and document system (source materials and reference documents), the following are produced: an annual internal audit program and the execution plan for each round (auditor independence; auditors do not audit their own work) → a checklist for each department (main clauses 4 to 10 + Annex A controls applied in the SoA) → an internal audit report if there are audit records → inputs for management review. Findings are passed on to 15 Nonconformity and Corrective Action.	Internal audit program and execution plan for each round: purpose, scope, criteria, schedule, timetable by department, auditor independence Checklist for each department: clause or Annex A control / points to check / audit method (documents, interview, site) / examples of objective evidence (controls excluded in the SoA are omitted) Internal audit report (when audit records exist: number of nonconformities and observations, findings, conclusion, follow-up actions → 15 Nonconformity and Corrective Action) and inputs for management review Mock audit: question and answer, one question at a time, with an AI auditor (ISO/IEC 42001); judgement and response tips for each answer, and a result report at the end (with a pass)
13 Legal Requirements Identification and Monitoring	4.1·4.2·6.1.3·9.1	Researches on the web the Ministry of Government Legislation (National Law Information Center, Citizen Legislation Participation Center), the competent ministries and official overseas sources (such as EUR-Lex), registers the AI-related laws and regulations applicable to the organization (AI role, business regions, personal information, automated decisions) in the AI legal requirements register, and checks every half year (January and July) and as needed for amendments and compliance status. The register is kept in this browser and becomes the basis of the next check, and is applied to risk assessment, impact assessment, SoA, use approval and management review.	AI legal requirements register (Excel): rows by clause and obligation, with applicable role, applicability, whether high-impact AI applies, linked step, promulgation and effective dates, source and date checked Changed legal requirements table; semiannual monitoring checksheet (conforming, nonconforming, not applicable, to be confirmed; evidence document number); action plan Key schedule (next semiannual check, effective dates, end of grace periods); application to AI work; summary of management review inputs
14 Management Review	9.3	Management review inputs (follow-up actions from previous management reviews, changes in external and internal issues, achievement of the AI policy and objectives, AI performance and monitoring, changes in risk and impact assessments, incidents, results of 12 Internal Audit and 13 Legal Requirements Identification and Monitoring, status of corrective actions, changes in interested parties and legal requirements, adequacy of resources, opportunities for improvement) are organized to draw out decisions, resources and changes from top management. Of the decisions, nonconformities are passed to 15 Nonconformity and Corrective Action, and improvement tasks to 16 Improvement.	Management review input summary (1 page): includes results of 12 Internal Audit and 13 Legal Requirements Identification and Monitoring, and the status of corrective actions Management review outputs: decisions, resources and changes (including decisions to update the risk assessment, impact assessment and Statement of Applicability), and a decision tracking table Guide to input materials and checklist (prepared Y/N, evidence, decisions needed); meeting facilitation; result report (as the meeting record) Three output streams: corrective action (→ 13), reflection in the next year's business plan, and education and training (→ 6, 9), together with the follow-up action register
15 Nonconformity and Corrective Action	10.2·10.1	Nonconformities are discussed with the AI one by one, based only on ISO/IEC 42001. In the "Nonconformity and corrective action consultation" window under Operate on the ICT Management System Operation screen, once you confirm G1 clause (main text, Annex A controls in the SoA) → G2 nonconformity description and grade → G3 root cause → G4 corrective measures (steps to redo) → G5 schedule and person in charge, it becomes an Excel nonconformity and corrective action register (31 columns, with formulas). It receives the findings of 12 Internal Audit (nonconformities and observations), the nonconformities and non-compliance from 13 Legal Requirements and Monitoring, and AI incidents; it corrects nonconformities, establishes corrective actions that find root causes and prevent recurrence, confirms their effectiveness, and then updates the risk assessment, impact assessment, Statement of Applicability and guidelines. Internal audit results are imported automatically from this browser.	Nonconformity and corrective action register: source (internal audit, legal check, incident) / clause or control / description / immediate action (correction) Cause analysis (5 Whys: shortcomings in data, algorithm, use and controls), corrective action plan, person responsible, deadline and completion criteria Effectiveness verification; list of updates to the risk assessment, impact assessment, Statement of Applicability and guidelines; input to the next management review
16 Improvement	10.1	Improvement opportunities arising from the decisions of 14 Management Review, the results of 15 Nonconformity and Corrective Action, observations and improvement recommendations from monitoring, internal audit and legal checks, and the opinions of interested parties are collected. From them, improvement tasks are set to continually improve the suitability, adequacy and effectiveness of the AI management system. After implementation and effects are verified, the results feed back into the next year's operation (1 Context Analysis, 5 Risk Assessment, 6 Impact Assessment, 7 SoA, AI objectives).	List of improvement opportunities: source (management review, corrective action, observation, monitoring, interested parties' opinions) / description / expected effect / priority Improvement task plan: person responsible, deadline, resources, performance indicators (before and after) and method of verifying effects Items to feed back into the next year's operation: updates to the risk assessment, impact assessment, SoA, AI objectives and training

Relationship Map of Operation Steps Inputs and outputs of the 16 steps, shown in figures and diagrams Expand

The 16 steps are not separate functions but one connected AI management system. The result (output) of one step becomes the input of the next, and the results of management review, improvement and monitoring return to earlier steps to refine the next cycle. In the diagram below, selecting a step shows only the inputs (green) it receives and the outputs (blue) it sends.

Show 10 reference document links

Input (received by this step)Output (sent by this step)Forward flowFeedback (later step → earlier step)10 Documented Information Management → reference documents for each step

Select a step by clicking it or by pressing Tab and then Enter, and below you will see where that step receives inputs from and where it sends outputs to.

Overview: the steps each step receives from and sends to

1 AI Context Analysis

←131416

→234567101314

2 AI Policy, Roles and Objectives

←14561112141516

→3571011121416

3 AI System Selection

←124916

→45

4 AI System Inventory

←13

→235689101213

5 AI Risk Assessment

←12341113141516

→267891011121415

6 AI System Impact Assessment

←145111416

→27891011

7 Control Implementation and Statement of Applicability (SoA)

←1256141516

→891011121315

8 Verification and Use Approval

←4567

→91011

9 Operational Control

←45678

→3101112131416

10 Documented Information Control

←12456789

→All steps

11 Monitoring, Change and Revision Control

←256789

→2561213141516

12 Internal Audit

←245791115

→2141516

13 Legal Requirements Identification and Monitoring

←147911

→15141516

14 Management Review

←12591112131516

→125671516

15 Nonconformity and Corrective Action

←5711121314

→257121416

16 Improvement

←291112131415

→12356714

View in detail as a grid (receiving step × sending step) Expand

Diagram: input and output table of the 16 steps

Row = receiving step, column = sending step. ● Input received from a preceding step · ◆ Input returned from a later step (feedback) · ▪ Reference document from Step 10 Documented Information Control. The rightmost column shows the number of inputs received; the bottom row shows the number of outputs sent.

Receiving step ＼ Sending step	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	Number of inputs
1 AI Context Analysis										▪			◆	◆		◆	4
2 AI Policy, Roles and Objectives	●			◆	◆	◆				▪	◆	◆		◆	◆	◆	10
3 AI System Selection	●	●		◆					◆	▪						◆	6
4 AI System Inventory	●		●							▪							3
5 AI Risk Assessment	●	●	●	●						▪	◆		◆	◆	◆	◆	10
6 AI System Impact Assessment	●			●	●					▪	◆			◆		◆	7
7 Control Implementation and Statement of Applicability (SoA)	●	●			●	●				▪				◆	◆	◆	8
8 Verification and Use Approval				●	●	●	●			▪							5
9 Operational Control				●	●	●	●	●		▪							6
10 Documented Information Control	●	●		●	●	●	●	●	●								8
11 Monitoring, Change and Revision Control		●			●	●	●	●	●	▪							7
12 Internal Audit		●		●	●		●		●	▪	●				◆		8
13 Legal Requirements Identification and Monitoring	●			●			●		●	▪	●						6
14 Management Review	●	●			●				●	▪	●	●	●		◆	◆	10
15 Nonconformity and Corrective Action					●		●			▪	●	●	●	●			7
16 Improvement		●							●	▪	●	●	●	●	●		8
Number of outputs	9	8	2	9	10	6	7	3	7	15	8	4	5	7	6	7

Operation step relationship map (integrated: ISO/IEC 42001 + ISO/IEC 27001) View the inputs and outputs of the 16 steps as a diagram and a table Expand

This is the 16-step linkage for operating both standards together. For each link, the reasons under [ISO/IEC 42001] and [ISO/IEC 27001] are both given. Links that exist only in 27001 (for example, 13 Legal Requirements Identification → 7 inclusion basis in the statement of applicability) are marked [ISO/IEC 27001 only], and links not used in 27001 (those relating to 6 Impact Assessment) are marked "[ISO/IEC 27001] Not applicable". The statement of applicability is separate for each standard, while the register is kept as one, with the applicable standard noted on each line.

Show 10 reference document links

Input (received by this step)Output (sent by this step)Forward flowFeedback (later step → earlier step)10 Documented Information Management → reference documents for each step

Select a step by clicking it or by pressing Tab and then Enter, and below you will see where that step receives inputs from and where it sends outputs to.

Overview: the steps each step receives from and sends to

1 AI Context Analysis

←131416

→234567101314

2 AI Policy, Roles and Objectives

←14561112141516

→3571011121416

3 AI System Selection

←124916

→45

4 AI System Inventory

←13

→235689101213

5 AI Risk Assessment

←12341113141516

→267891011121415

6 AI System Impact Assessment

←145111416

→27891011

7 Control Implementation and Statement of Applicability (SoA)

←125613141516

→891011121315

8 Verification and Use Approval

←4567

→91011

9 Operational Control

←45678

→3101112131416

10 Documented Information Control

←12456789

→All steps

11 Monitoring, Change and Revision Control

←256789

→2561213141516

12 Internal Audit

←245791115

→2141516

13 Legal Requirements Identification and Monitoring

←147911

→157141516

14 Management Review

←12591112131516

→125671516

15 Nonconformity and Corrective Action

←5711121314

→257121416

16 Improvement

←291112131415

→12356714

View in detail as a grid (receiving step × sending step) Expand

Diagram: Combined input and output table of the 16 steps

Row = receiving step, column = sending step. ● Input received from a preceding step · ◆ Input returning from a later step (feedback) · ▪ Reference document of 10 Documented Information Management. Hover over a cell to see the reasons for the two standards.

Receiving step ＼ Sending step	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	Number of inputs
1 AI Context Analysis										▪			◆	◆		◆	4
2 AI Policy, Roles and Objectives	●			◆	◆	◆				▪	◆	◆		◆	◆	◆	10
3 AI System Selection	●	●		◆					◆	▪						◆	6
4 AI System Inventory	●		●							▪							3
5 AI Risk Assessment	●	●	●	●						▪	◆		◆	◆	◆	◆	10
6 AI System Impact Assessment	●			●	●					▪	◆			◆		◆	7
7 Control Implementation and Statement of Applicability (SoA)	●	●			●	●				▪			◆	◆	◆	◆	9
8 Verification and Use Approval				●	●	●	●			▪							5
9 Operational Control				●	●	●	●	●		▪							6
10 Documented Information Control	●	●		●	●	●	●	●	●								8
11 Monitoring, Change and Revision Control		●			●	●	●	●	●	▪							7
12 Internal Audit		●		●	●		●		●	▪	●				◆		8
13 Legal Requirements Identification and Monitoring	●			●			●		●	▪	●						6
14 Management Review	●	●			●				●	▪	●	●	●		◆	◆	10
15 Nonconformity and Corrective Action					●		●			▪	●	●	●	●			7
16 Improvement		●							●	▪	●	●	●	●	●		8
Number of outputs	9	8	2	9	10	6	7	3	7	15	8	4	6	7	6	7

Evaluation method (common to all steps) Expand

Six axes for task selection (six criteria for choosing tasks in which to use AI): frequency of repetition · difficulty of judgment · cost of errors (the cost if wrong) · data confidentiality level (A public · B internal · C customer and personal information) · AI impact level (recruitment, personnel evaluation, safety, qualification decisions and credit decisions are always "High") · need for human oversight → P1 introduce immediately · P2 AI draft + approval by a designated reviewer · P3 defer.
Scope of use LEVEL (the range in which AI is used): 1 Individual · 2 Department · 3 Site · 4 Company-wide → assessment type: excluded, simplified or formal (formal if there is exposure to external customers, large-scale processing of personal information or automated decision-making about people, LEVEL 3 or 4, or integration with live core-system data).
Risk score (magnitude of the risk) = likelihood (how likely it is to occur, 1 to 5, where 5 = at least once a month or on every input and 1 = less than once in 3 years) × severity (the damage if it occurs, 1 to 5, the highest value among the three axes of business, individual and society, with the adopted axis noted, e.g. 4-individual): 1 to 6 low risk · 7 to 12 medium risk · 13 to 19 high risk (impact assessment mandatory, deployment on hold) · 20 to 25 critical (immediate mitigation and report to top management).
Six risk categories: technical · data · ethical and social · legal and regulatory · business and supply chain · life cycle. Seven treatment options: avoid · pursue the opportunity · eliminate the source · reduce likelihood · reduce consequences (human intervention, double checking, alternative means) · transfer or share · accept.
Seven impact assessment areas: safety · fairness · transparency and explainability · personal information · security · human management and oversight · society and environment. If even one area is rated "High", the result is conditional approval or hold.
Human oversight: the real authority of a person to review, intervene in and override the decisions and outputs of AI; it is not merely watching a screen.

ICT Management System Operation GuideOperating (Write with AI) is done on the ICT Management System Operation screen. The standard and industry you select carry over to that screen.

Selecting the standard and operation steps

When you select the standard to operate, a draft of the work for the selected steps is written to fit that standard's requirements. The requirements consist of the clauses and subclauses of the common chapter structure used by ISO standards (the harmonized structure, HS) and the requirements specific to each standard (for example, ISO 14001: environmental aspects and compliance evaluation; ISO 45001: risk assessment and worker participation).
If you select several standards, common requirements are written once, and standard-specific requirements are written separately with the standard name attached. Pass per standard: it is not sold by step and is not paid in advance.
If you click "Write with AI" for a standard without a pass, the cost is shown first, and if you agree, payment is made on the spot and writing continues.

Run now ↓

Until AI writing is connected, please leave a message via "Contact staff".After entering your input, click "Write with AI". If you agree to the cost notice, the payment screen opens, and after payment you return to this page and continue with your input as it was.
The output appears after the document completeness check (80 points). On-screen payment (card, simple payment) is being prepared. Before then, or if you prefer a bank transfer, click "Contact staff". A staff member will explain the amount and the payment method, and will open access after confirming the deposit (eiso Pricing).

Operation track *	Economic Prosperity Social Value ICT Management System Operation Economic Prosperity (based on ISO 9001) or Social Value (environmental protection and social justice): only the standards and 20 steps of the selected track are shown (if you turn on "Integrated management system" in the common steps, the standards of both tracks are selected together). If you select ICT (ISO/IEC 42001 and 27001), you are taken to ICT Management System Operation. The industry is passed on, and step results are carried over from one to the next in this browser.
Standard to operate *	Economic prosperity ISO 9001 Quality ISO 22000 Food safety ISO 13485 Medical devices ISO 19443 Nuclear IATF 16949 Automotive (IATF recognized) ISO 21001 Educational organizations Environmental protection ISO 14001 Environment ISO 50001 Energy Social Justice ISO 45001 Occupational health and safety ISO 37001 Anti-bribery ISO 37301 Compliance ISO 22301 Business continuity * Only standards typically associated with management system certification have been selected. We will keep improving the platform to help you establish and operate the selected standards.
Operation mode	Integrated operation Independent operation per standard Shown only when two or more standards are selected. Integrated operation runs the selected standards as one flow; independent operation per standard is done separately for each standard on its own operation platform (tabs above).
Industry *	For 1 Context of the Organization, please enter your industry. The opportunities, threats and interested parties of the industry are researched on the web. The selected standards and industry apply to every operation step. Each step reflects the processes, equipment, risks, legal requirements and interested-party characteristics of the industry.
Operation step *
1 Context of the Organization: first analyze interested parties (4.2), then analyze the context of the organization (4.1) with the selected methods When you enter your industry, the AI researches on the web the external trends (opportunities and threats) of that industry and the needs and expectations of interested parties, and analyzes them together with the content and materials you provide (sources and reference dates are shown). From this it prepares a proposed decision on the requirements your company will address (adopt) in its management system, and links them to risks, objectives and legal requirements. Legal requirements are adopted; other requirements are each marked as proposed for adoption, needs review or not addressed, with reasons (decisions and approval rest with your company). Internal strengths and weaknesses are drawn only from your materials and input. Where there is no basis, the AI asks under "Items to be confirmed".
Analysis method *	First choose the analysis method (more than one is possible): only the sections for the methods you choose are written. Interested party analysis (4.2) Identifying interested parties, needs and expectations, clause mapping, 4.2 self-diagnosis: to be done first SWOT analysis Strengths, weaknesses, opportunities, threats + cross strategies (SO, ST, WO, WT) PESTEL analysis Political, economic, social, technological, environmental and legal factors + industry structure (5 Forces) 7M analysis Internal analysis from the viewpoints of people, equipment, materials, methods, measurement, environment and management (funding) Interested party analysis (4.2) comes before the analysis of the context of the organization, so it is selected by default together with SWOT. If you select nothing, interested party analysis + SWOT is used.
Upload materials	📁 Select a folder📄 Upload files (multiple) When you upload a folder or several files, each file is placed in a field according to its file name. Business plan → current-year business plan; management review, performance, analysis, KPI → previous-year management analysis materials; strengths, weaknesses, SWOT, audit, survey → strengths and weaknesses analysis materials; everything else → summary of situation and materials. After placing, you can edit or delete them in the field.
Names to mask	DOCX, XLSX, PPTX, HWPX, PDF and TXT. Files are read only within your browser and only the text is used (not stored, not used for AI training).
Business plan for the current year	Read from file »
Management analysis materials for the previous year	Read from file »
Strengths and weaknesses analysis materials	Read from file »
Basic information
Company website
17 Internal Audit: from your materials, an audit plan → checklists per audit unit → an internal audit report after the audit When you specify a folder or upload files (manuals, procedures, organization chart, roles and responsibilities, risk assessment, objectives, statement of applicability, previous audit results), the AI matches the requirements of the standard against your processes and documents, and prepares an audit plan and checklists to support the internal auditors. After the audit, enter the audit records and write the internal audit report on the same screen (findings not in the records are not written). For Annex A controls, the applicability declarations in your statement of applicability (SoA) take priority.
Upload materials	📁 Select folder📄 Upload files (multiple) Each file is placed in a field according to its file name. Forms and templates (audit plan, checklist, audit report) → customer forms; statement of applicability, SoA → statement of applicability; previous audits, nonconformities, corrective actions, NCR → previous audit results; audit records, checklist results (when “Internal audit report” is selected) → audit records; everything else (manuals, procedures, organization chart, roles and responsibilities, etc.) → audit materials.
To be prepared	Internal audit plan Annual program, plan for this round, schedule, auditor assignment and independence check; the audit schedule and auditor information are required Checklist A table for each audit unit: No, clause, control, requirement, open audit questions, evidence, result (OK, OFI, Minor, Major) Internal audit report After the audit: summary, findings, nonconformity reports (NCR) and conclusion, based only on the audit records you enter Management review input summary A one-page summary of the audit results as input to 18 Management Review (9.3.2)
Audit type
Audit unit	What to divide the checklist by: for departments and divisions, clauses are assigned using the organization chart and roles and responsibilities; for processes, using the process map; for projects, using the life cycle.
Audit subjects and number of items
Audit schedule	For the “Internal audit plan”, the schedule and auditor information are required. Auditors are assigned so that they do not audit their own work or department.
Auditor information
Audit materials	Read from file »
Customer forms (audit plan, checklist, audit report)	Read from file »
Statement of Applicability (SoA)	Read from file »
Previous audit results	Read from file »
Audit records (for the report)	Read from file »
Specify the basic data on your computer: specify the folder or files for this step When you specify the basic data accumulated on your computer for this step (records, results, current forms, documents), eiso organizes, aggregates and analyzes it, and synthesizes the result. Files are read only inside your browser, and only the text is placed in the fields below. Nothing is sent to a server or stored.
Designate materials	📁 Designate folder📄 Designate files (multiple)
Materials on your computer
Department or process
Summary of situation and materials *	For 1 Context of the Organization, this may be left blank if basic information or the materials below are provided.
Requests
Company Workspace	Carry over results of previous steps Company Workspace When you select a Company Workspace, the AI carries over the results of previous steps you have saved (for example, issues from context of the organization → risk assessment; risks → process control, audit checklists and management review input). The Company Workspace is being prepared. When it opens, we will announce it in the Announcements.

Copy Download as Word

* AI-generated output is a reference draft and does not guarantee certification.: AGENT eiso.co.kr